Background processes on a Windows OS that run without a user interface.
They can be set to start automatically in the background at specific times or at boot.
Management
Services are managed by the Service Control Manager (SCM) services.msc.
They can also be viewed and configured with the PowerShell Module Microsoft.PowerShell.Management.
Service permissions can be viewed an managed with the sc sdshow command or Get-Acl with PowerShell.
Status
Services can be set as:
- Running
- Stopped
- Paused
Critical services that require system restart to be stopped or restarted
| Service | Description |
|---|---|
| smss.exe | Session Manager SubSystem. Responsible |
| for handling sessions on the system. | |
| csrss.exe | Client Server Runtime Process. The |
| user-mode portion of the Windows | |
| subsystem. | |
| wininit.exe | Starts the Wininit file .ini file that |
| lists all of the changes to be made to | |
| Windows when the computer is | |
| restarted after installing a program. | |
| logonui.exe | Used for facilitating user login into a |
| PC | |
| lsass.exe | The Local Security Authentication Server |
| verifies the validity of user logons to | |
| a PC or server. It generates the | |
| process responsible for authenticating | |
| users for the Winlogon service. | |
| services.exe | Manages the operation of starting and |
| stopping services. | |
| winlogon.exe | Responsible for handling the secure |
| attention sequence, loading a user | |
| profile on logon, and locking the | |
| computer | |
| when a screensaver is running. | |
| System | A background system process that runs |
| the Windows kernel. | |
| svchost.exe with RPCSS | Manages system services that run from |
| dynamic-link libraries. Uses the Remote | |
| Procedure Call (RPC) Service (RPCSS). | |
| svchost.exe with Dcom/PnP | Manages system services that run from |
| dynamic-link libraries. Uses the | |
| Distributed Component Object Model | |
| (DCOM) | |
| and Plug and Play (PnP) services. |