47

In my machine there's a service called CDPUserSvc_1bf5729. The description says

Failed to Read Description. Error Code: 15100

The path to the executable is C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup, and the startup type is Automatic. If I attempt to set the startup type to Disabled, I got an error message saying "The parameter is incorrect".

What is this service?

enter image description here

Chin
  • 7,883
  • 22
  • 69
  • 95
  • 1
    Don't know why MS hasn't seen it but this is a pretty bad name for a process or service. It means that viral processes can also use a arbitrary name like `CDPUserSvc_1bf5729` and users won't be able to tell whether its a bad process or virus.. thus hiding legit viruses.. – alpha_989 Aug 12 '18 at 03:14
  • From your screenshot it seems texts on your screen are blurry. Try [this method](https://superuser.com/questions/947391/windows-10-font-blurry-125-scaling/1374131#1374131) to fix that problem. – Sнаđошƒаӽ Jan 31 '19 at 14:48
  • i have similar question, can someone please check ?https://superuser.com/questions/1597730/started-seeing-this-two-services-suddenly-cdpusersvc-604aa-and-cbdhsvc-604aa/1597735#1597735 – Dhaval Pankhaniya Oct 27 '20 at 16:33
  • 2
    The name ending in a hash is because it is running for a specific user. Windows supports multiple user accounts simultaneously logged in at the same time and this service runs with the relevant user’s account to limit the damage to the system or other users if the service is compromised. Anyway, to be registered as a service, it probably needs a unique name, so to avoid having a name that conflicts with another user account’s service, the hash is appended. – binki Jun 18 '22 at 16:02
  • 1
    You can read more about _per-user services_ in the [official documentation](https://docs.microsoft.com/en-us/windows/application-management/per-user-services-in-windows). – Daniel B Sep 11 '22 at 13:36

3 Answers3

21

It's part of Connected Devices Platform Service.

CDP Service itself says: This service is used for Connected Devices and Universal Glass scenarios.

The files are all c:\windows\system32\cdp*.dll:

cdp.dll
cdprt.dll
cdpusersvc.dll
cdprefernce.exe

Slightly more about that here: http://www.tenforums.com/general-support/58863-connected-devices-platform-service-what-does-do.html

I recommend reading the reference to the ZDNet Article on "Project Rome" in the link above.

If you use "strings" on the cdpusersvc.dll you will find references to Universal Glass and a few other backend bits.

Gaff
  • 18,569
  • 15
  • 57
  • 68
TG2
  • 874
  • 6
  • 8
  • 10
    "CDP Service itself says: This service is used for Connected Devices and Universal Glass scenarios" ... yes, the service can say whatever it wants to. It could just say "hi, I'm a service". As a developer, I'm a bit concerned about seeing all these strange, non-configurable services showing up as "updates" to the operating system. I have also had a tough time shutting this particular, name-changing service off. – Patrick Sep 05 '16 at 12:35
  • 2
    @3498DB, if its a legit service.. will it still have the random string at the end (`1bf5729`)? I haven't ever seen a legit service which has such a random tag at the end? – alpha_989 Aug 12 '18 at 03:06
  • On [technet](https://social.technet.microsoft.com/Forums/azure/en-US/c165a54a-4a69-441c-94a7-b5712b54385d/what-is-the-cdpusersvc-for-#11e6c35c-ee23-441a-87d9-02a77a81af56), it is alleged that may be just to uniquely distinguish "set of services" running across users (possibly via [client impersonation](https://docs.microsoft.com/en-us/windows/win32/secauthz/client-impersonation) I believe, so that you don't *actually* have them duplicated). – mirh Oct 02 '19 at 12:24
  • 2
    Is there any reason for having those random letters/numbers at the end? They differ from mine, and from other people too. – Nicke Manarin Nov 21 '19 at 17:08
11

If you want to disable the service, you can do so by modifying both the registry keys with the name:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDPUserSvc

In both keys, modify the value Start from 2 to 4 and restart.

Ryakna
  • 1,100
  • 2
  • 12
  • 29
3

The reason it fails to read the description is actually because the service doesn't have a describer assigned to it. The services' description tag is empty so it's basically trying to read a description that is not there.

It should not effect it's ability to run and perform. Descriptions are for user's eyes only and have nothing to do with the actual functionality of the system.

It cannot be disabled because the service is a critical kernel-level service, just like how the RPC service is. Disabling it will cause core components to fail. It's also required for the settings app to function and any windows store apps that use wireless adapters (Bluetooth, NFC, etc) will fail to run. The service is deliberately locked by the Windows team to keep people from disabling the service and BSOD their PCs (I was able to remove most of the security around this service to disable it on a test machine. Each time it will blue screen when disabled).

Quilnux
  • 47
  • 1
  • 3
    This doesn't ring true; I have disabled this service on Windows 10 Pro v1709 (and its companion service with the same name but appended with a random string), and it didn't cause me to crash. In fact, it *fixed* my inexplicable WiFi disconnecting issue. – TylerH Dec 21 '17 at 14:50
  • Super creepy that a service that tracks literally everything you do on your PC can't be disabled. I found an activitiescache.db file that has stored almost 400mb of programs i've opened and this service was locking it. – Migit May 24 '23 at 21:38