Search notes:

Windows services

A service is an executable (application) that runs in the background, that is, without a GUI and therefore without (direct) interaction with users.
An example for a service is the SQL Server instance.
Some Windows components are also implemented as servcices, to name a few:
Some services are run by %systemroot%\system32\svchost.exe.
Information about each service on a system is stored in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
It should be noted that Microsoft not only refers to background processes as services, but also to device drivers. This is, imho, confusing.

Service names

A service has three names:

Required components for a service

A service requires three components:

Service Control Manager (SCM)

Services are started, stopped and generally controlled by the Service Control Manager (SCM) which is implemented in services.exe.
It is possible to communicate with the Service Control Manager with sc.exe or the MMC Snap in services.msc.

Service verbs

The Service Control Manager communicates to a service basically with the following four verbs:
Therefore, a service needs to at least implement these four primitives.

Searching/displaying services

PowerShell

In order to show installed services on a system or filter them in PowerShell, one has to use
  • the get-service, or alternatively
  • get-cimInstance in combination with the class name win32_service (get-cimService -classname win32_service ‥).
For example, the following command queries the executable that implements a given service: 
PS:> (get-cimInstance -className Win32_Service -filter "name='xdrHealth'").pathName
"C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe"

User Account

A service executes in the security context of a user account.
There are three special predefined local accounts for services. These accounts are not recognized by the security subsystem (and hence are not look-up-able with LookupAccountName and don't have a password). See also S-1-5-18 / S-1-5-19 / S-1-5-20
The user account under which a service runs can be determined with variations of the following PowerShell commands: 
(get-cimInstance -className win32_service -filter "name='W32Time'").startName
get-cimInstance -className win32_service | select-object name,startname
In the registry, this account is stored in the value ObjectName under the key\ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\driverName.

Installed services after a fresh Windows 10 installation

This following table shows the services I found after a fresh installation of Windows 10.
Update 2025-07-31, Windows 11: I have added cmservice to the list (but I am not sure if this service was added when I enabled virtualization on the machine).
The table was extracted using format-table to print the full column width: 
PS C:\> get-service | format-table -wrap -autosize
AJRouter AllJoyn Router Service Stopped
ALG Application Layer Gateway Service Stopped
AMD External Events Utility AMD External Events Utility Running
AppIDSvc Application Identity Stopped
Appinfo Application Information Running
AppMgmt Application Management Stopped
AppReadiness App Readiness Stopped
AppVClient Microsoft App-V Client Stopped
AppXSvc AppX Deployment Service (AppXSVC) Running
AssignedAccessManagerSvc AssignedAccessManager Service Stopped
AudioEndpointBuilder Windows Audio Endpoint Builder Running
Audiosrv Windows Audio Running
AxInstSV ActiveX Installer (AxInstSV) Stopped
BcastDVRUserService_1839e BcastDVRUserService_1839e Stopped
BDESVC BitLocker Drive Encryption Service Stopped
BFE Base Filtering Engine Running
BITS Background Intelligent Transfer Service Running
BluetoothUserService_1839e BluetoothUserService_1839e Stopped
BrokerInfrastructure Background Tasks Infrastructure Service Running
BTAGService Bluetooth Audio Gateway Service Stopped
BthAvctpSvc AVCTP service Stopped
bthserv Bluetooth Support Service Stopped
camsvc Capability Access Manager Service Running
cmservice Container Manager Service Running
CaptureService_1839e CaptureService_1839e Stopped
CDPSvc Connected Devices Platform Service Running
CDPUserSvc_1839e CDPUserSvc_1839e Running
CertPropSvc Certificate Propagation Running
ClipSVC Client License Service (ClipSVC) Stopped
COMSysApp COM+ System Application Stopped
CoreMessagingRegistrar CoreMessaging Running
CryptSvc Cryptographic Services Running
CscService Offline Files Stopped
DcomLaunch DCOM Server Process Launcher Running
defragsvc Optimize drives Stopped
DeviceAssociationService Device Association Service Stopped
DeviceInstall Device Install Service Stopped
DevicePickerUserSvc_1839e DevicePickerUserSvc_1839e Stopped
DevicesFlowUserSvc_1839e DevicesFlowUserSvc_1839e Stopped
DevQueryBroker DevQuery Background Discovery Broker Stopped
Dhcp DHCP Client Running
diagnosticshub.standardcollector.service Microsoft (R) Diagnostics Hub Standard Collector Service Stopped
diagsvc Diagnostic Execution Service Stopped
DiagTrack Connected User Experiences and Telemetry Running
DmEnrollmentSvc Device Management Enrollment Service Stopped
dmwappushservice dmwappushsvc Stopped
Dnscache DNS Client Running
DoSvc Delivery Optimization Stopped
dot3svc Wired AutoConfig Stopped
DPS Diagnostic Policy Service Running
DsmSvc Device Setup Manager Stopped
DsSvc Data Sharing Service Running
DusmSvc Data Usage Running
Eaphost Extensible Authentication Protocol Stopped
EFS Encrypting File System (EFS) Stopped
embeddedmode Embedded Mode Stopped
EntAppSvc Enterprise App Management Service Stopped
EventLog Windows Event Log Running
EventSystem COM+ Event System Running
Fax Fax Stopped
fdPHost Function Discovery Provider Host Stopped
FDResPub Function Discovery Resource Publication Stopped
fhsvc File History Service Stopped
FontCache Windows Font Cache Service Running
FrameServer Windows Camera Frame Server Stopped
gpsvc Group Policy Client Running
GraphicsPerfSvc GraphicsPerfSvc Stopped
hidserv Human Interface Device Service Running
HvHost HV Host Service Stopped
icssvc Windows Mobile Hotspot Service Stopped
IKEEXT IKE and AuthIP IPsec Keying Modules Stopped
InstallService Microsoft Store Install Service Stopped
iphlpsvc IP Helper Running
IpxlatCfgSvc IP Translation Configuration Service Stopped
irmon Infrared monitor service Stopped
KeyIso CNG Key Isolation Running
KtmRm KtmRm for Distributed Transaction Coordinator Stopped
LanmanServer Server Running
LanmanWorkstation Workstation Running
lfsvc Geolocation Service Running
LicenseManager Windows License Manager Service Running
lltdsvc Link-Layer Topology Discovery Mapper Stopped
lmhosts TCP/IP NetBIOS Helper Running
LSM Local Session Manager Running
LxpSvc Language Experience Service Stopped
MapsBroker Downloaded Maps Manager Stopped
MessagingService_1839e MessagingService_1839e Stopped
mpssvc Windows Defender Firewall Running
MSDTC Distributed Transaction Coordinator Stopped
MSiSCSI Microsoft iSCSI Initiator Service Stopped
msiserver Windows Installer Stopped
NaturalAuthentication Natural Authentication Stopped
NcaSvc Network Connectivity Assistant Stopped
NcbService Network Connection Broker Running
NcdAutoSetup Network Connected Devices Auto-Setup Stopped
Netlogon Netlogon Stopped
Netman Network Connections Stopped
netprofm Network List Service Running
NetSetupSvc Network Setup Service Stopped
NetTcpPortSharing Net.Tcp Port Sharing Service Stopped
NgcCtnrSvc Microsoft Passport Container Stopped
NgcSvc Microsoft Passport Stopped
NlaSvc Network Location Awareness Running
nsi Network Store Interface Service Running
OneSyncSvc_1839e OneSyncSvc_1839e Running
p2pimsvc Peer Networking Identity Manager Stopped
p2psvc Peer Networking Grouping Stopped
PcaSvc Program Compatibility Assistant Service Running
PeerDistSvc BranchCache Stopped
PerfHost Performance Counter DLL Host Stopped
PhoneSvc Phone Service Stopped
PimIndexMaintenanceSvc_1839e PimIndexMaintenanceSvc_1839e Running
pla Performance Logs & Alerts Stopped
PlugPlay Plug and Play Running
PNRPAutoReg PNRP Machine Name Publication Service Stopped
PNRPsvc Peer Name Resolution Protocol Stopped
PolicyAgent IPsec Policy Agent Stopped
Power Power Running
PrintNotify Printer Extensions and Notifications Stopped
PrintWorkflowUserSvc_1839e PrintWorkflowUserSvc_1839e Stopped
ProfSvc User Profile Service Running
PushToInstall Windows PushToInstall Service Stopped
QWAVE Quality Windows Audio Video Experience Stopped
RasAuto Remote Access Auto Connection Manager Stopped
RasMan Remote Access Connection Manager Running
RemoteAccess Routing and Remote Access Stopped
RemoteRegistry Remote Registry Stopped
RetailDemo Retail Demo Service Stopped
RmSvc Radio Management Service Stopped
RpcEptMapper RPC Endpoint Mapper Running
RpcLocator Remote Procedure Call (RPC) Locator Stopped
RpcSs Remote Procedure Call (RPC) Running
SamSs Security Accounts Manager Running
SCardSvr Smart Card Stopped
ScDeviceEnum Smart Card Device Enumeration Service Stopped
Schedule Task Scheduler Running
SCPolicySvc Smart Card Removal Policy Stopped
SDRSVC Windows Backup Stopped
seclogon Secondary Logon Stopped
SecurityHealthService Windows Defender Security Center Service Running
sedsvc Windows Remediation Service Running
SEMgrSvc Payments and NFC/SE Manager Running
Sense Windows Defender Advanced Threat Protection Service Stopped
SensorDataService Sensor Data Service Stopped
SensorService Sensor Service Running
SensrSvc Sensor Monitoring Service Stopped
SENS System Event Notification Service Running
SessionEnv Remote Desktop Configuration Stopped
SgrmBroker System Guard Runtime Monitor Broker Running
SharedAccess Internet Connection Sharing (ICS) Stopped
SharedRealitySvc Spatial Data Service Stopped
ShellHWDetection Shell Hardware Detection Running
shpamsvc Shared PC Account Manager Stopped
smphost Microsoft Storage Spaces SMP Stopped
SmsRouter Microsoft Windows SMS Router Service. Stopped
SNMPTRAP SNMP Trap Stopped
spectrum Windows Perception Service Stopped
Spooler Print Spooler Running
sppsvc Software Protection Stopped
SSDPSRV SSDP Discovery Running
ssh-agent OpenSSH Authentication Agent Stopped
SstpSvc Secure Socket Tunneling Protocol Service Running
StateRepository State Repository Service Running
stisvc Windows Image Acquisition (WIA) Stopped
StorSvc Storage Service Running
svsvc Spot Verifier Stopped
swprv Microsoft Software Shadow Copy Provider Stopped
SysMain Superfetch Running
SystemEventsBroker System Events Broker Running
TabletInputService Touch Keyboard and Handwriting Panel Service Running
TapiSrv Telephony Stopped
TermService Remote Desktop Services Stopped
Themes Themes Running
TieringEngineService Storage Tiers Management Stopped
TimeBrokerSvc Time Broker Running
TokenBroker Web Account Manager Running
TrkWks Distributed Link Tracking Client Running
TrustedInstaller Windows Modules Installer Stopped
tzautoupdate Auto Time Zone Updater Stopped
UevAgentService User Experience Virtualization Service Stopped
UmRdpService Remote Desktop Services UserMode Port Redirector Stopped
UnistoreSvc_1839e UnistoreSvc_1839e Running
upnphost UPnP Device Host Stopped
UserDataSvc_1839e UserDataSvc_1839e Running
UserManager User Manager Running
UsoSvc Update Orchestrator Service Running
VacSvc Volumetric Audio Compositor Service Stopped
VaultSvc Credential Manager Running
vds Virtual Disk Stopped
vmicguestinterface Hyper-V Guest Service Interface Stopped
vmicheartbeat Hyper-V Heartbeat Service Stopped
vmickvpexchange Hyper-V Data Exchange Service Stopped
vmicrdv Hyper-V Remote Desktop Virtualization Service Stopped
vmicshutdown Hyper-V Guest Shutdown Service Stopped
vmictimesync Hyper-V Time Synchronization Service Stopped
vmicvmsession Hyper-V PowerShell Direct Service Stopped
vmicvss Hyper-V Volume Shadow Copy Requestor Stopped
VSS Volume Shadow Copy Stopped
W32Time Windows Time Stopped
WaaSMedicSvc Windows Update Medic Service Stopped
WalletService WalletService Stopped
WarpJITSvc WarpJITSvc Stopped
wbengine Block Level Backup Engine Service Stopped
WbioSrvc Windows Biometric Service Stopped
Wcmsvc Windows Connection Manager Running
wcncsvc Windows Connect Now - Config Registrar Stopped
WdiServiceHost Diagnostic Service Host Running
WdiSystemHost Diagnostic System Host Running
WdNisSvc Windows Defender Antivirus Network Inspection Service Running
WebClient WebClient Stopped
Wecsvc Windows Event Collector Stopped
WEPHOSTSVC Windows Encryption Provider Host Service Stopped
wercplsupport Problem Reports and Solutions Control Panel Support Stopped
WerSvc Windows Error Reporting Service Stopped
WFDSConMgrSvc Wi-Fi Direct Services Connection Manager Service Stopped
WiaRpc Still Image Acquisition Events Stopped
WinDefend Windows Defender Antivirus Service Running
WinHttpAutoProxySvc WinHTTP Web Proxy Auto-Discovery Service Running
Winmgmt Windows Management Instrumentation Running
WinRM Windows Remote Management (WS-Management) Stopped
wisvc Windows Insider Service Stopped
WlanSvc WLAN AutoConfig Running
wlidsvc Microsoft Account Sign-in Assistant Running
wlpasvc Local Profile Assistant Service Stopped
wmiApSrv WMI Performance Adapter Stopped
WMPNetworkSvc Windows Media Player Network Sharing Service Stopped
workfolderssvc Work Folders Stopped
WpcMonSvc Parental Controls Stopped
WPDBusEnum Portable Device Enumerator Service Stopped
WpnService Windows Push Notifications System Service Running
WpnUserService_1839e WpnUserService_1839e Running
wscsvc Security Center Running
WSearch Windows Search Running
wuauserv Windows Update Running
WwanSvc WWAN AutoConfig Stopped
xbgm Xbox Game Monitoring Stopped
XblAuthManager Xbox Live Auth Manager Stopped
XblGameSave Xbox Live Game Save Stopped
XboxGipSvc Xbox Accessory Management Service Stopped
XboxNetApiSvc Xbox Live Networking Service Stopped
Another way to list services is using WMIC.exe in cmd.exe: 
C:\> wmic service get displayName,processId,started,pathName
C:\> wmic service where "name like '%mssql%'" get name
msconfig.exe has a checkbox under the Services tab that allows to view non-Microsoft services only.

TODO

at.exe: The schedule service command line interface
The registry apparently refers to device drivers as services - yet, these two have not much in common. (See also driverquery.exe)

See also

services.msc, sc.exe
The well known SID S-1-5-80 (sc qsidtype serviceName).
net stop, net pause, net continue and net start
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
The value of NoInteractiveServices under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows determines if a service is allowed to run interactively.
The Powershell command noun: service
SQL Server Agent
The .NET class System.ServiceProcess.ServiceController` represents a service.
The presence of the cexecsvc service indicates that an environment is running inside a Docker container.
Programs that might automatically be started in Windows
Services that run on behalf of Windows run under the SYSTEM account which is identified by the well-known SID S-1-5-18.
The -psn command line option of the debugging tools for Windows.
Enumerate Services with c / WinAPI
A service is a securable object.

Index

Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 8 attempt to write a readonly database in /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php:78 Stack trace: #0 /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php(78): PDOStatement->execute(Array) #1 /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php(30): insert_webrequest_('/notes/Windows/...', 1788248409, '216.73.217.21', 'Mozilla/5.0 App...', NULL) #2 /home/httpd/vhosts/renenyffenegger.ch/httpsdocs/notes/Windows/services/index(440): insert_webrequest() #3 {main} thrown in /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php on line 78