Services to Keep¶
Disabling the wrong service is as bad as leaving a bad one running. These are the ones that must stay on, and how to check that an image hasn't turned them off.
Always on¶
| Display name | Name | Why |
|---|---|---|
| Windows Event Log | EventLog |
No logging without it. Attackers disable it before acting. |
| Microsoft Defender Antivirus Service | WinDefend |
Antivirus |
| Windows Defender Firewall | mpssvc |
Firewall |
| Windows Update | wuauserv |
Patching. Startup type Manual is the Windows default and is fine; Disabled is not. |
| Security Accounts Manager | SamSs |
Local account database |
| Cryptographic Services | CryptSvc |
Certificate and signature checks |
| Windows Time | W32Time |
Correct clocks, which logs and Kerberos depend on |
| Task Scheduler | Schedule |
Windows' own maintenance |
| Security Center | wscsvc |
The Windows Security dashboard |
On when the README says so¶
| Role | Service | Name |
|---|---|---|
| Print server | Print Spooler | Spooler |
| DNS server | DNS Server | DNS |
| Web server | World Wide Web Publishing Service | W3SVC |
| FTP server (IIS) | Microsoft FTP Service | ftpsvc |
| FTP server (FileZilla) | FileZilla Server | FileZilla-Server |
| Mail server (MailEnable) | MailEnable services | MEIMAPS, MEPOPS, MESMTPCS and others |
| File server | Server | LanmanServer |
| Remote administration | Remote Desktop Services | TermService |
| SSH | OpenSSH SSH Server | sshd |
| Domain controller | Active Directory Domain Services, DNS, Kerberos, Netlogon | NTDS, DNS, Kdc, Netlogon |
Print Spooler on a machine that isn't a print server can be disabled; it has a history of serious vulnerabilities.
Check them¶
Get-Service EventLog, WinDefend, mpssvc, wuauserv, SamSs, W32Time | Select Name, Status, StartType
Name Status StartType
---- ------ ---------
EventLog Running Automatic
WinDefend Stopped Disabled
mpssvc Running Automatic
wuauserv Stopped Disabled
SamSs Running Automatic
W32Time Running Manual
Two problems there. Fix:
Set-Service WinDefend -StartupType Automatic; Start-Service WinDefend
Set-Service wuauserv -StartupType Manual; Start-Service wuauserv
If WinDefend won't start, a policy may be disabling Defender. See Defender Status.
When a service won't start¶
- Error 1058: the service cannot be started because it is disabled. Set the startup type first.
- Access denied. Your prompt isn't elevated.
- The dependency service failed to start. Right-click the service → Properties → Dependencies tab lists what it needs. Start those first.