Services to Disable¶
A service is a program Windows runs in the background, usually from boot. Many accept network connections. Any one the machine doesn't need for its job is a door with nobody watching it.
The rule¶
The README describes the machine's job. A file server needs the Server service. A web server needs IIS. A workstation needs neither. Anything the job doesn't require gets stopped and disabled.
When you aren't sure, check the README's required-services list, then read the service's description before touching it. Disabling something the scenario depends on breaks the machine and costs points.
How to stop and disable¶
Stop-Service RemoteRegistry
Set-Service RemoteRegistry -StartupType Disabled
Or both at once:
Set-Service RemoteRegistry -StartupType Disabled -Status Stopped
services.msc → double-click the service → Startup type: Disabled → Stop → OK.
"Stopped" alone isn't enough; it starts again at the next boot. "Disabled" is the part that lasts.
Level 1: services that should not run¶
Services that should not run on a workstation, and usually not on a server unless it's that server's job. The Name column is what PowerShell uses.
| CIS | Display name | Name | What it exposes |
|---|---|---|---|
| 5.3 | Computer Browser | Browser |
Legacy network browsing; usually not installed |
| 5.7 | IIS Admin Service | IISADMIN |
IIS management. Only on a web server. |
| 5.8 | Infrared monitor service | irmon |
No infrared on a VM |
| 5.10 | Microsoft FTP Service | ftpsvc |
File transfer with plaintext passwords |
| 5.12 | OpenSSH SSH Server | sshd |
Remote shell. Only if the README requires SSH. |
| 5.23 | Remote Procedure Call (RPC) Locator | RpcLocator |
Legacy RPC name service |
| 5.25 | Routing and Remote Access | RemoteAccess |
Turns the machine into a router or VPN server |
| 5.27 | Simple TCP/IP Services | simptcp |
Echo, discard, daytime. Nothing uses them. |
| 5.29 | Special Administration Console Helper | sacsvr |
Emergency management console over serial |
| 5.30 | SSDP Discovery | SSDPSRV |
Advertises the machine to the network |
| 5.31 | UPnP Device Host | upnphost |
Lets devices open ports automatically |
| 5.32 | Web Management Service | WMSvc |
Remote IIS management |
| 5.35 | Windows Media Player Network Sharing Service | WMPNetworkSvc |
Streams media to the network |
| 5.36 | Windows Mobile Hotspot Service | icssvc |
Shares the machine's internet as a Wi-Fi hotspot |
| 5.40 | World Wide Web Publishing Service | W3SVC |
IIS. Only on a web server. |
| 5.41 | Xbox Accessory Management Service | XboxGipSvc |
Game controllers |
| 5.42 | Xbox Live Auth Manager | XblAuthManager |
Xbox sign-in |
| 5.43 | Xbox Live Game Save | XblGameSave |
Game saves to the cloud |
| 5.44 | Xbox Live Networking Service | XboxNetApiSvc |
Xbox networking |
The STIG adds Secondary Logon (seclogon, WN11-00-000175): it's the service behind "Run as different user," and disabling it stops a user launching a program as another account.
Not in the CIS benchmark but worth disabling on any workstation: Telnet (TlntSvr), SNMP Trap (SNMPTRAP), WebClient (WebClient), Net.Tcp Port Sharing (NetTcpPortSharing), Telephony (tapisrv), LPD Service (LPDSVC).
Level 2: the locked-down list¶
Level 2 disables anything a high-security workstation doesn't need. Four of these break things a scenario may depend on; confirm with the README before disabling Server (file sharing), Print Spooler (printing), Remote Desktop Services (RDP), and WinRM (remote management).
| CIS | Display name | Name | Why |
|---|---|---|---|
| 5.1 | Bluetooth Audio Gateway Service | BTAGService |
No Bluetooth on a VM |
| 5.2 | Bluetooth Support Service | bthserv |
Same |
| 5.4 | Downloaded Maps Manager | MapsBroker |
Maps app background downloads |
| 5.5 | GameInput Service | GameInputSvc |
Game controller support |
| 5.6 | Geolocation Service | lfsvc |
Reports the machine's location to apps |
| 5.9 | Link-Layer Topology Discovery Mapper | lltdsvc |
Network mapping; also tells the network about this machine |
| 5.11 | Microsoft iSCSI Initiator Service | MSiSCSI |
Network storage protocol; unused on workstations |
| 5.13 | Peer Name Resolution Protocol | PNRPsvc |
Peer-to-peer name resolution |
| 5.14 | Peer Networking Grouping | p2psvc |
Peer-to-peer collaboration |
| 5.15 | Peer Networking Identity Manager | p2pimsvc |
Same family |
| 5.16 | PNRP Machine Name Publication Service | PNRPAutoReg |
Same family |
| 5.17 | Print Spooler | Spooler |
Long history of privilege-escalation bugs. Disable if the machine doesn't print. |
| 5.18 | Problem Reports and Solutions Control Panel Support | wercplsupport |
Error reporting UI |
| 5.19 | Remote Access Auto Connection Manager | RasAuto |
Auto-dials VPN connections |
| 5.20 | Remote Desktop Configuration | SessionEnv |
Part of RDP |
| 5.21 | Remote Desktop Services | TermService |
RDP itself. Disable unless the README requires it. |
| 5.22 | Remote Desktop Services UserMode Port Redirector | UmRdpService |
RDP device redirection |
| 5.24 | Remote Registry | RemoteRegistry |
Registry edits from the network |
| 5.26 | Server | LanmanServer |
File and printer sharing from this machine. Disable only if nothing is shared. |
| 5.28 | SNMP Service | SNMP |
Network management, weak authentication |
| 5.33 | Windows Error Reporting Service | WerSvc |
Sends crash data to Microsoft |
| 5.34 | Windows Event Collector | Wecsvc |
Receives forwarded events; a workstation doesn't collect |
| 5.37 | Windows Push Notifications System Service | WpnService |
Cloud push notifications |
| 5.38 | Windows PushToInstall Service | PushToInstall |
Lets the Store install apps remotely |
| 5.39 | Windows Remote Management | WinRM |
PowerShell remoting |
Apply¶
Level 1, safe on any image:
$l1 = "Browser","IISADMIN","irmon","ftpsvc","RpcLocator","RemoteAccess","simptcp","sacsvr","SSDPSRV","upnphost",
"WMSvc","WMPNetworkSvc","icssvc","W3SVC","XboxGipSvc","XblAuthManager","XblGameSave","XboxNetApiSvc",
"TlntSvr","SNMPTRAP","WebClient","NetTcpPortSharing","tapisrv","LPDSVC","seclogon"
$l1 | ForEach-Object { Set-Service $_ -StartupType Disabled -ErrorAction SilentlyContinue; Stop-Service $_ -Force -ErrorAction SilentlyContinue }
Level 2, minus the four README-dependent ones:
$l2 = "BTAGService","bthserv","MapsBroker","GameInputSvc","lfsvc","lltdsvc","MSiSCSI","PNRPsvc","p2psvc","p2pimsvc",
"PNRPAutoReg","wercplsupport","RasAuto","SessionEnv","UmRdpService","RemoteRegistry","SNMP","WerSvc","Wecsvc",
"WpnService","PushToInstall"
$l2 | ForEach-Object { Set-Service $_ -StartupType Disabled -ErrorAction SilentlyContinue; Stop-Service $_ -Force -ErrorAction SilentlyContinue }
Then, only when the README allows:
Set-Service Spooler -StartupType Disabled -Status Stopped
Set-Service TermService -StartupType Disabled -Status Stopped
Set-Service WinRM -StartupType Disabled -Status Stopped
Set-Service LanmanServer -StartupType Disabled -Status Stopped
Services that aren't installed are skipped silently. sshd and W3SVC are in the Level 1 list; remove them from the command if the README requires SSH or a web server.
Verify¶
Get-Service RemoteRegistry, TlntSvr, SSDPSRV, upnphost, WebClient | Select Name, Status, StartType
All should show Stopped and Disabled. Then run netstat -abno again and confirm the ports closed.
Example¶
services.msc shows Remote Registry running, startup Automatic. Nothing in the README mentions remote management. Disable it. Also SSDP Discovery and UPnP Device Host are running; both exist to make home networks convenient and have no place on a work machine. Disable both.