System Services

Table 6.1 shows the system services and their default configurations, including the Log On As account settings for a default installation of Windows Server 2003.

Unless otherwise noted, the Startup type and Log On As accounts are the same for all members of the Windows Server 2003 family.

Table 6.1. Default Services and Their Settings

Service Name (Short Name )	Startup Type	Logs On As
Alerter	Disabled	Local Service
Application Layer Gateway (ALG)	Manual	Local Service
Application Management (AppMgmt)	Manual	Local System
Automatic Updates (wuauserv)	Automatic	Local System
Background Intelligent Transfer Service (BITS)	Manual	Local System
ClipBook (ClipSrv)	Disabled	Local System
COM+ Event System (EventSystem)	Manual/Started	Local System
COM+ System Application (COMSysApp)	Manual	Local System
Computer Browser (Browser)	Automatic/Started	Local System
Cryptographic Services (CryptSvc)	Automatic/Started	Local System
DHCP Client (DHCP)	Automatic/Started	Network Service
Distributed File System (DFS)	Automatic/Started	Local System
Distributed Link Tracking Client (TrkWks)	Automatic/Started	Local System
Distributed Link Tracking Server (TrkSvr)	Disabled	Local System
Distributed Transaction Coordinator (MSDTC)	Automatic/Started	Network Service
DNS Client (Dnscache)	Automatic/Started	Network Service
Error Reporting Service (ERSvc)	Automatic/Started	Local System
Event Log (Eventlog)	Automatic/Started	Local System
File Replication (ntfrs)	Manual	Local System
Help and Support (helpsvc)	Automatic/Started	Local System
HTTP SSL (W3SSL)	Manual	Local System
Human Interface Device Access (HidServ)	Disabled	Local System
IIS Admin (IISADMIN)	Automatic/Started	Local System
IMAPI CD-Burning COM Service (ImapiService)	Disabled	Local System
Indexing Service (cisvc)	Manual	Local System
ICF/ICS (SharedAccess)	Disabled	Local System
Intersite Messaging (IsmServ)	Disabled	Local System
IPSec Services (PolicyAgent)	Automatic/Started	Local System
Kerberos Key Distribution Center (KDC)	Disabled	Local System
License Logging (LicenseService)	Disabled	Network Service
Logical Disk Manager (dmserver)	Automatic/Started	Local System
Logical Disk Manager Administrative Service (dmadmin)	Manual	Local System
Messenger (messenger)	Disabled	Local System
Microsoft Software Shadow Copy Provider (SWPRV)	Manual	Network Service
Net Logon (Netlogon)	Varies	Local System
NetMeeting Remote Desktop Sharing (mnmsrvc)	Disabled	Local System
Network Connections (Netman)	Manual/Started	Local System
Network DDE (NetDDE)	Disabled	Local System
Network DDE DSDM (NetDDEDSDM)	Disabled	Local System
Network Location Awareness (NLA)	Manual/Started	Local System
NT LM Security Support Provider (NtLmSsp)	Manual	Local System
Performance Logs and Alerts (SysmonLog)	Manual	Network Service
Plug and Play (PlugPlay)	Automatic/Started	Local System
Portable Media Serial Number (WmdmPmSp)	Manual	Local System
Print Spooler (Spooler)	Automatic/Started	Local System
Protected Storage (ProtectedStorage)	Automatic/Started	Local System
Remote Access Auto Connection Manager (RasAuto)	Manual	Local System
Remote Access Connection Manager (RasMan)	Manual	Local System
Remote Desktop Help Session Manager (RDSessMgr)	Manual	Local System
Remote Procedure Call (RpcSs)	Automatic/Started	Local System
Remote Procedure Call (RPC) Locator (RpcLocator)	Manual	Network Service
Remote Registry (RemoteRegistry)	Automatic/Started	Local Service
Removable Storage (NtmsSvc)	Manual	Local System
Resultant Set of Policy Provider (RsoPProv)	Manual	Local System
Routing and Remote Access (RemoteAccess)	Disabled	Local System
Secondary Logon (seclogon)	Automatic/Started	Local System
Security Accounts Manager (SamSs)	Automatic/Started	Local System
Server (lanmanserver)	Automatic/Started	Local System
Shell Hardware Detection (ShellHWDetection)	Automatic/Started	Local System
Simple Mail Transfer Protocol (SMTPSVC)	Automatic/Started	Local System
Smart Card (ScardSvr)	Manual	Local Service
Special Administration Console Helper (Sacsvr)	Manual	Local System
System Event Notification (SENS)	Automatic/Started	Local System
Task Scheduler (Schedule)	Automatic/Started	Local System
TCP/IP NetBIOS Helper (LmHosts)	Automatic/Started	Local Service
Telephony (TapiSrv)	Manual	Local System
Telnet (TlntSvr)	Disabled	Local System
Terminal Services (TermService)	Manual/Started	Local System
Terminal Services Session Directory (Tssdis)	Disabled	Local System
Themes (Themes)	Disabled	Local System
Uninterruptible Power Supply (UPS)	Manual	Local Service
Upload Manager (uploadmgr)	Manual	Local System
Virtual Disk Service (VDS)	Manual	Local System
Volume Shadow Copy (VSS)	Manual	Local System
WebClient (WebClient)	Disabled	Local Service
Windows Audio (AudioSrv)	Automatic/Started	Local System
Windows Image Acquisition (stisvc)	Disabled	Local System
Windows Installer (MSIServer)	Manual	Local System
Windows Management Instrumentation (winmgmt)	Automatic/Started	Local System
Windows Management Instrumentation Driver Extensions (wmi)	Manual	Local System
Windows Time (W32time)	Automatic	Local System
WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)	Manual/Started	Local System
Wireless Configuration (WZCSVC)	Automatic/Started	Local System
WMI Performance Adapter (WmiApSrv)	Manual	Local System
Workstation (lanmanworkstation)	Automatic/Started	Local System
World Wide Web Publishing (W3SVC)	Automatic/Started	Local System

This new default configuration goes a long way toward preparing a formal level of security for Windows Server 2003 base installations, but many options beyond the defaults can be configured to further secure system deployments in the enterprise.