_raw:
Type=Service
Name="FrameServerMonitor"
DisplayName="Windows Camera Frame Server Monitor"
Description="Monitors the health and state for the Windows Camera Frame Server service."
Path="C:\Windows\System32\svchost.exe -k CameraMonitor"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="FrameServer"
DisplayName="Windows Camera Frame Server"
Description="Enables multiple clients to access video frames from camera devices."
Path="C:\Windows\System32\svchost.exe -k Camera"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0

_sourcetype: WinHostMon

source: service

sourcetype: WinHostMon


_raw:
Type=Service
Name="FontCache"
DisplayName="Windows Font Cache Service"
Description="Optimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade application performance."
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1952


_raw:
Type=Service
Name="FDResPub"
DisplayName="Function Discovery Resource Publication"
Description="Publishes this computer and resources attached to this computer so they can be discovered over the network.  If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network."
Path="C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="fdPHost"
DisplayName="Function Discovery Provider Host"
Description="The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services – Discovery (WS-D) protocol. Stopping or disabling the FDPHOST service will disable network discovery for these protocols when using FD. When this service is unavailable, network services using FD and relying on these discovery protocols will be unable to find network devices or resources."
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="EventSystem"
DisplayName="COM+ Event System"
Description="Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1432


_raw:
Type=Service
Name="EventLog"
DisplayName="Windows Event Log"
Description="This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system."
Path="C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1252


_raw:
Type=Service
Name="EntAppSvc"
DisplayName="Enterprise App Management Service"
Description="Enables enterprise application management."
Path="C:\Windows\system32\svchost.exe -k appmodel -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="embeddedmode"
DisplayName="Embedded Mode"
Description="The Embedded Mode service enables scenarios related to Background Applications.  Disabling this service will prevent Background Applications from being activated."
Path="C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="EFS"
DisplayName="Encrypting File System (EFS)"
Description="Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files."
Path="C:\Windows\System32\lsass.exe"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=660


_raw:
Type=Service
Name="edgeupdatem"
DisplayName="Microsoft Edge Update Service (edgeupdatem)"
Description="Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it."
Path=""C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="edgeupdate"
DisplayName="Microsoft Edge Update Service (edgeupdate)"
Description="Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it."
Path=""C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc"
ServiceType="Own Process"
StartMode="Auto"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="EapHost"
DisplayName="Extensible Authentication Protocol"
Description="The Extensible Authentication Protocol (EAP) service provides network authentication in such scenarios as 802.1x wired and wireless, VPN, and Network Access Protection (NAP).  EAP also provides application programming interfaces (APIs) that are used by network access clients, including wireless and VPN clients, during the authentication process.  If you disable this service, this computer is prevented from accessing networks that require EAP authentication."
Path="C:\Windows\System32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DsSvc"
DisplayName="Data Sharing Service"
Description="Provides data brokering between applications."
Path="C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=2416


_raw:
Type=Service
Name="DsRoleSvc"
DisplayName="DS Role Server"
Description="This service hosts the DS Role Server used for DC promotion, demotion, and cloning. If this service is disabled, these operations will fail."
Path="C:\Windows\System32\lsass.exe"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DsmSvc"
DisplayName="Device Setup Manager"
Description="Enables the detection, download and installation of device-related software. If this service is disabled, devices may be configured with outdated software, and may not work correctly."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=2052


_raw:
Type=Service
Name="DPS"
DisplayName="Diagnostic Policy Service"
Description="The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components.  If this service is stopped, diagnostics will no longer function."
Path="C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=4612


_raw:
Type=Service
Name="dot3svc"
DisplayName="Wired AutoConfig"
Description="The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X authentication on Ethernet interfaces. If your current wired network deployment enforces 802.1X authentication, the DOT3SVC service should be configured to run for establishing Layer 2 connectivity and/or providing access to network resources. Wired networks that do not enforce 802.1X authentication are unaffected by the DOT3SVC service."
Path="C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DoSvc"
DisplayName="Delivery Optimization"
Description="Performs content delivery optimization tasks"
Path="C:\Windows\System32\svchost.exe -k NetworkService -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Dnscache"
DisplayName="DNS Client"
Description="The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k NetworkService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1292


_raw:
Type=Service
Name="DNS"
DisplayName="DNS Server"
Description="Enables DNS clients to resolve DNS names by answering DNS queries and dynamic DNS update requests. If this service is stopped, DNS updates will not occur. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\dns.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=3092


_raw:
Type=Service
Name="dmwappushservice"
DisplayName="Device Management Wireless Application Protocol (WAP) Push message Routing Service"
Description="Routes Wireless Application Protocol (WAP) Push messages received by the device and synchronizes Device Management sessions"
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DmEnrollmentSvc"
DisplayName="Device Management Enrollment Service"
Description="Performs Device Enrollment Activities for Device Management"
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DispBrokerDesktopSvc"
DisplayName="Display Policy Service"
Description="Manages the connection and configuration of local and remote displays"
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2856


_raw:
Type=Service
Name="DiagTrack"
DisplayName="Connected User Experiences and Telemetry"
Description="The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event driven collection and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled under Feedback and Diagnostics."
Path="C:\Windows\System32\svchost.exe -k utcsvc -p"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2964


_raw:
Type=Service
Name="diagnosticshub.standardcollector.service"
DisplayName="Microsoft (R) Diagnostics Hub Standard Collector Service"
Description="Diagnostics Hub Standard Collector Service. When running, this service collects real time ETW events and processes them."
Path="C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Dhcp"
DisplayName="DHCP Client"
Description="Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1160


_raw:
Type=Service
Name="DFSR"
DisplayName="DFS Replication"
Description="Enables you to synchronize folders on multiple servers across local or wide area network (WAN) network connections. This service uses the Remote Differential Compression (RDC) protocol to update only the portions of files that have changed since the last replication."
Path="C:\Windows\system32\DFSRs.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2608


_raw:
Type=Service
Name="Dfs"
DisplayName="DFS Namespace"
Description="Enables you to group shared folders located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders."
Path="C:\Windows\system32\dfssvc.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=3368


_raw:
Type=Service
Name="DevQueryBroker"
DisplayName="DevQuery Background Discovery Broker"
Description="Enables apps to discover devices with a backgroud task"
Path="C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DeviceInstall"
DisplayName="Device Install Service"
Description="Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability."
Path="C:\Windows\system32\svchost.exe -k DcomLaunch -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DeviceAssociationService"
DisplayName="Device Association Service"
Description="Enables pairing between the system and wired or wireless devices."
Path="C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="defragsvc"
DisplayName="Optimize drives"
Description="Helps the computer run more efficiently by optimizing files on storage drives."
Path="C:\Windows\system32\svchost.exe -k defragsvc"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="dcsvc"
DisplayName="Declared Configuration(DC) service"
Description="Process Declared Configuration documents recevied from MDM and other channels and perform configurations on device"
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="DcomLaunch"
DisplayName="DCOM Server Process Launcher"
Description="The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running."
Path="C:\Windows\system32\svchost.exe -k DcomLaunch -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=860


_raw:
Type=Service
Name="CscService"
DisplayName="Offline Files"
Description="The Offline Files service performs maintenance activities on the Offline Files cache, responds to user logon and logoff events, implements the internals of the public API, and dispatches interesting events to those interested in Offline Files activities and changes in cache state."
Path="C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="CryptSvc"
DisplayName="Cryptographic Services"
Description="Provides three management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update and enable scenarios such as SSL. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k NetworkService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1640


_raw:
Type=Service
Name="CoreMessagingRegistrar"
DisplayName="CoreMessaging"
Description="Manages communication between system components."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2760


_raw:
Type=Service
Name="COMSysApp"
DisplayName="COM+ System Application"
Description="Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="cloudbase-init"
DisplayName="cloudbase-init"
Description="Cloud Initialization Service"
Path="C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\OpenStackService.exe" cloudbase-init "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Scripts\cloudbase-init.exe" --config-file "C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf"
ServiceType="Own Process"
StartMode="Auto"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="ClipSVC"
DisplayName="Client License Service (ClipSVC)"
Description="Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave correctly."
Path="C:\Windows\System32\svchost.exe -k wsappx -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="CertPropSvc"
DisplayName="Certificate Propagation"
Description="Copies user certificates and root certificates from smart cards into the current user's certificate store, detects when a smart card is inserted into a smart card reader, and, if needed, installs the smart card Plug and Play minidriver."
Path="C:\Windows\system32\svchost.exe -k netsvcs"
ServiceType="Share Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=1932


_raw:
Type=Service
Name="CDPSvc"
DisplayName="Connected Devices Platform Service"
Description="This service is used for Connected Devices Platform scenarios"
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=5004


_raw:
Type=Service
Name="camsvc"
DisplayName="Capability Access Manager Service"
Description="Provides facilities for managing UWP apps access to app capabilities as well as checking an app's access to specific app capabilities"
Path="C:\Windows\system32\svchost.exe -k appmodel -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="bthserv"
DisplayName="Bluetooth Support Service"
Description="The Bluetooth service supports discovery and association of remote Bluetooth devices.  Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly and prevent new devices from being discovered or associated."
Path="C:\Windows\system32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="BrokerInfrastructure"
DisplayName="Background Tasks Infrastructure Service"
Description="Windows infrastructure service that controls which background tasks can run on the system."
Path="C:\Windows\system32\svchost.exe -k DcomLaunch -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=860


_raw:
Type=Service
Name="BITS"
DisplayName="Background Intelligent Transfer Service"
Description="Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information."
Path="C:\Windows\System32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="BFE"
DisplayName="Base Filtering Engine"
Description="The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1644


_raw:
Type=Service
Name="BalloonService"
DisplayName="BalloonService"
Description="Balloon Service"
Path="C:\Program Files\Virtio-Win\Balloon\blnsvr.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=3216


_raw:
Type=Service
Name="AxInstSV"
DisplayName="ActiveX Installer (AxInstSV)"
Description="Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation of ActiveX controls will behave according to default browser settings."
Path="C:\Windows\system32\svchost.exe -k AxInstSVGroup"
ServiceType="Share Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Audiosrv"
DisplayName="Windows Audio"
Description="Manages audio for Windows-based programs.  If this service is stopped, audio devices and effects will not function properly.  If this service is disabled, any services that explicitly depend on it will fail to start"
Path="C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AudioEndpointBuilder"
DisplayName="Windows Audio Endpoint Builder"
Description="Manages audio devices for the Windows Audio service.  If this service is stopped, audio devices and effects will not function properly.  If this service is disabled, any services that explicitly depend on it will fail to start"
Path="C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AppXSvc"
DisplayName="AppX Deployment Service (AppXSVC)"
Description="Provides infrastructure support for deploying Store applications. This service is started on demand and if disabled Store applications will not be deployed to the system, and may not function properly."
Path="C:\Windows\system32\svchost.exe -k wsappx -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AppVClient"
DisplayName="Microsoft App-V Client"
Description="Manages App-V users and virtual applications"
Path="C:\Windows\system32\AppVClient.exe"
ServiceType="Own Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AppReadiness"
DisplayName="App Readiness"
Description="Gets apps ready for use the first time a user signs in to this PC and when adding new apps."
Path="C:\Windows\System32\svchost.exe -k AppReadiness -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AppMgmt"
DisplayName="Application Management"
Description="Processes installation, removal, and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove, or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Appinfo"
DisplayName="Application Information"
Description="Facilitates the running of interactive applications with additional administrative privileges.  If this service is stopped, users will be unable to launch applications with the additional administrative privileges they may require to perform desired user tasks."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AppIDSvc"
DisplayName="Application Identity"
Description="Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="ALG"
DisplayName="Application Layer Gateway Service"
Description="Provides support for 3rd party protocol plug-ins for Internet Connection Sharing"
Path="C:\Windows\System32\alg.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="AJRouter"
DisplayName="AllJoyn Router Service"
Description="Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundled routers will be unable to run."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="ADWS"
DisplayName="Active Directory Web Services"
Description="This service provides a Web Service interface to instances of the directory service (AD DS and AD LDS) that are running locally on this server. If this service is stopped or disabled, client applications, such as Active Directory PowerShell, will not be able to access or manage any directory service instances that are running locally on this server."
Path="C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2776


_raw:
Type=Service
Name="MDCoreSvc"
DisplayName="Microsoft Defender Core Service"
Description="Monitors the availability, health, and performance of various security components"
Path="C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.6-0\MpDefenderCoreService.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2896


_raw:
Type=Service
Name="SplunkForwarder"
DisplayName="SplunkForwarder"
Description="SplunkForwarder is the remote data collection service for Splunk, a data platform for operational intelligence. If it is stopped, Splunk will stop collecting and sending data to Splunk indexers, which may result in data loss. Please see www.splunk.com for more information. Questions can be submitted to www.splunk.com/answers or for supported customers www.splunk.com/page/submit_issue"
Path=""C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=196


_raw:
Type=Service
Name="GoogleChromeElevationService"
DisplayName="Google Chrome Elevation Service (GoogleChromeElevationService)"
Description="Provides encryption services and a secure way for recovering Google Chrome if it gets out of date. If this service is disabled, Google Chrome may lose access to encrypted data, and Google Chrome may not be able recover itself."
Path="C:\Program Files\Google\Chrome\Application\143.0.7499.193\elevation_service.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="GoogleUpdaterService144.0.7547.0"
DisplayName="Google Updater Service (GoogleUpdaterService144.0.7547.0)"
Description="Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it."
Path=""C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update"
ServiceType="Own Process"
StartMode="Auto"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="GoogleUpdaterInternalService144.0.7547.0"
DisplayName="Google Updater Internal Service (GoogleUpdaterInternalService144.0.7547.0)"
Description="Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it."
Path=""C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal"
ServiceType="Own Process"
StartMode="Auto"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="wuauserv"
DisplayName="Windows Update"
Description="Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=1696


_raw:
Type=Service
Name="WSearch"
DisplayName="Windows Search"
Description="Provides content indexing, property caching, and search results for files, e-mail, and other content."
Path="C:\Windows\system32\SearchIndexer.exe /Embedding"
ServiceType="Own Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WpnService"
DisplayName="Windows Push Notifications System Service"
Description="This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2912


_raw:
Type=Service
Name="WPDBusEnum"
DisplayName="Portable Device Enumerator Service"
Description="Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and Image Import Wizard to transfer and synchronize content using removable mass-storage devices."
Path="C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WMPNetworkSvc"
DisplayName="Windows Media Player Network Sharing Service"
Description="Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play"
Path="C:\Program Files\Windows Media Player\wmpnetwk.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="wmiApSrv"
DisplayName="WMI Performance Adapter"
Description="Provides performance library information from Windows Management Instrumentation (WMI) providers to clients on the network. This service only runs when Performance Data Helper is activated."
Path="C:\Windows\system32\wbem\WmiApSrv.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=4584


_raw:
Type=Service
Name="wlidsvc"
DisplayName="Microsoft Account Sign-in Assistant"
Description="Enables user sign-in through Microsoft account identity services. If this service is stopped, users will not be able to logon to the computer with their Microsoft account."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="wisvc"
DisplayName="Windows Insider Service"
Description="Provides infrastructure support for the Windows Insider Program. This service must remain enabled for the Windows Insider Program to work."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Disabled"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WinRM"
DisplayName="Windows Remote Management (WS-Management)"
Description="Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them. The WinRM Service needs to be configured with a listener using winrm.cmd command line tool or through Group Policy in order for it to listen over the network. The WinRM service provides access to WMI data and enables event collection. Event collection and subscription to events require that the service is running. WinRM messages use HTTP and HTTPS as transports. The WinRM service does not depend on IIS but is preconfigured to share a port with IIS on the same machine.  The WinRM service reserves the /wsman URL prefix. To prevent conflicts with IIS, administrators should ensure that any websites hosted on IIS do not use the /wsman URL prefix."
Path="C:\Windows\System32\svchost.exe -k NetworkService -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2816


_raw:
Type=Service
Name="Winmgmt"
DisplayName="Windows Management Instrumentation"
Description="Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start."
Path="C:\Windows\system32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=2608


_raw:
Type=Service
Name="WinHttpAutoProxySvc"
DisplayName="WinHTTP Web Proxy Auto-Discovery Service"
Description="WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=true
State="Running"
Status="OK"
ProcessId=1356


_raw:
Type=Service
Name="WinDefend"
DisplayName="Microsoft Defender Antivirus Service"
Description="Helps protect users from malware and other potentially unwanted software"
Path="C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.6-0\MsMpEng.exe"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=3636


_raw:
Type=Service
Name="WiaRpc"
DisplayName="Still Image Acquisition Events"
Description="Launches applications associated with still image acquisition events."
Path="C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WerSvc"
DisplayName="Windows Error Reporting Service"
Description="Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and repair services. If this service is stopped, error reporting might not work correctly and results of diagnostic services and repairs might not be displayed."
Path="C:\Windows\System32\svchost.exe -k WerSvcGroup"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="wercplsupport"
DisplayName="Problem Reports Control Panel Support"
Description="This service provides support for viewing, sending and deletion of system-level problem reports for the Problem Reports control panel."
Path="C:\Windows\System32\svchost.exe -k netsvcs -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WEPHOSTSVC"
DisplayName="Windows Encryption Provider Host Service"
Description="Windows Encryption Provider Host Service brokers encryption related functionalities from 3rd Party Encryption Providers to processes that need to evaluate and apply EAS policies. Stopping this will compromise EAS compliancy checks that have been established by the connected Mail Accounts"
Path="C:\Windows\system32\svchost.exe -k WepHostSvcGroup"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Wecsvc"
DisplayName="Windows Event Collector"
Description="This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If this service is stopped or disabled event subscriptions cannot be created and forwarded events cannot be accepted."
Path="C:\Windows\system32\svchost.exe -k NetworkService -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WdNisSvc"
DisplayName="Microsoft Defender Antivirus Network Inspection Service"
Description="Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols"
Path="C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.6-0\NisSrv.exe"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WdiSystemHost"
DisplayName="Diagnostic System Host"
Description="The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context.  If this service is stopped, any diagnostics that depend on it will no longer function."
Path="C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WdiServiceHost"
DisplayName="Diagnostic Service Host"
Description="The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context.  If this service is stopped, any diagnostics that depend on it will no longer function."
Path="C:\Windows\System32\svchost.exe -k LocalService -p"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="Wcmsvc"
DisplayName="Windows Connection Manager"
Description="Makes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC and enables management of network connectivity based on Group Policy settings."
Path="C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
ServiceType="Own Process"
StartMode="Auto"
Started=true
State="Running"
Status="OK"
ProcessId=1760


_raw:
Type=Service
Name="WbioSrvc"
DisplayName="Windows Biometric Service"
Description="The Windows biometric service gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to any biometric hardware or samples. The service is hosted in a privileged SVCHOST process."
Path="C:\Windows\system32\svchost.exe -k WbioSvcGroup"
ServiceType="Share Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0


_raw:
Type=Service
Name="WarpJITSvc"
DisplayName="Warp JIT Service"
Description="Enables JIT compilation support in d3d10warp.dll for processes in which code generation is disabled."
Path="C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted"
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0