Windows 10 - Which services and Windows features and so on are unnecesary and can be safely disabled?

Question

I am a Windows power user, tweaker, and tinkerer. I use Windows Explorer, cmd, Control Panel, PowerShell and everything that can be accessed from the Control Panel very often.

Recently I have done a repair install/update on my computer, updated my operating system from Windows 10 2009 to Windows 10 20H2 (Windows 10 Pro N for Workstations x64), because I have run the following:

dism /online /cleanup-image /scanhealth
dism /online /cleanup-image /restorehealth
dism /online /cleanup-image /restorehealth /source:D:\sources\install.wim
sfc /scannow

Over and over again and they kept saying my "system is fine, everything is fixed..." despite the fact that my system wasn't fine and everything remained unfixed...

There existed a myriad small problems, and I have tried everything I can find online except reinstalling OS because I didn't want to reinstall Windows again. I suspect they must be related to registry, caused by my modifying of the system, because my hardware is potato (underpowered), having only 4 GB RAM with Intel HD Graphics, total usable primary memory 3798 MB, and a 2.00 GHz quad-core CPU...

So far these are what I did to my system. I disabled dozens of unnecessary services and features, because I know I don't need them.

I am not administrating a server of any kind. I don't use streaming services, I don't encrypt my hard disk, and I don't have any Bluetooth device or Xbox or any other toys.

I am not in a homegroup, I am not file sharing, I don't use NFS, I don't have any contacts, I am using wired broadband PPPoE Ethernet connection, my computer is desktop, and I don't use printers.

I don't use any human interface devices, I have no smart card, I don't sync settings, and I don't use autoplay and autorun...

File WindowsServicesToBeDisabled.txt/

AppHostSvc
BDESVC
BthAvctpSvc
CDPSvc
CertPropSvc
CscService
DPS
DeviceAssociationService
DiagTrack
DusmSvc
EFS
FDResPub
FontCache
FontCache3.0.0.0
IISADMIN
MSMQ
MSMQTriggers
NetMsmqActivator
NfsClnt
PcaSvc
PhoneSvc
PrintNotify
QWAVE
RemoteAccess
RemoteRegistry
RmSvc
SCPolicySvc
SCardSvr
SSDPSRV
ScDeviceEnum
SessionEnv
SharedAccess
ShellHWDetection
Spooler
SysMain
TabletInputService
TapiSrv
TermService
UmRdpService
WSearch
WbioSrvc
WdiServiceHost
WdiSystemHost
WerSvc
WlanSvc
WwanSvc
autotimesvc
bthserv
fdPHost
ftpsvc
hidserv
icssvc
vds
wercplsupport

File WindowsFeaturesToBeDisabled.txt

Printing-PrintToPDFServices-Features
Printing-XPSServices-Features
SearchEngine-Client-Package
MSRDC-Infrastructure
TelnetClient
TFTP
TIFFIFilter
Printing-Foundation-Features
Printing-Foundation-InternetPrinting-Client
Printing-Foundation-LPDPrintService
Printing-Foundation-LPRPortMonitor
Windows-Identity-Foundation
WCF-HTTP-Activation
WCF-NonHTTP-Activation
IIS-WebServerRole
IIS-WebServer
IIS-CommonHttpFeatures
IIS-HttpErrors
IIS-HttpRedirect
IIS-ApplicationDevelopment
IIS-Security
IIS-RequestFiltering
IIS-NetFxExtensibility
IIS-NetFxExtensibility45
IIS-HealthAndDiagnostics
IIS-HttpLogging
IIS-LoggingLibraries
IIS-RequestMonitor
IIS-HttpTracing
IIS-URLAuthorization
IIS-IPSecurity
IIS-Performance
IIS-HttpCompressionDynamic
IIS-WebServerManagementTools
IIS-ManagementScriptingTools
IIS-IIS6ManagementCompatibility
IIS-Metabase
WAS-WindowsActivationService
WAS-ProcessModel
WAS-NetFxEnvironment
WAS-ConfigurationAPI
IIS-HostableWebCore
WCF-HTTP-Activation45
WCF-TCP-Activation45
WCF-Pipe-Activation45
WCF-MSMQ-Activation45
IIS-StaticContent
IIS-DefaultDocument
IIS-DirectoryBrowsing
IIS-WebDAV
IIS-WebSockets
IIS-ApplicationInit
IIS-ASPNET
IIS-ASPNET45
IIS-ASP
IIS-CGI
IIS-ISAPIExtensions
IIS-ISAPIFilter
IIS-ServerSideIncludes
IIS-CustomLogging
IIS-BasicAuthentication
IIS-HttpCompressionStatic
IIS-ManagementConsole
IIS-ManagementService
IIS-WMICompatibility
IIS-LegacyScripts
IIS-LegacySnapIn
IIS-FTPServer
IIS-FTPSvc
IIS-FTPExtensibility
MSMQ-Container
MSMQ-DCOMProxy
MSMQ-Server
MSMQ-ADIntegration
MSMQ-HTTP
MSMQ-Multicast
MSMQ-Triggers
IIS-CertProvider
IIS-WindowsAuthentication
IIS-DigestAuthentication
IIS-ClientCertificateMappingAuthentication
IIS-IISCertificateMappingAuthentication
IIS-ODBCLogging
DataCenterBridging
SmbDirect
HostGuardian
MultiPoint-Connector
MultiPoint-Connector-Services
MultiPoint-Tools
Windows-Defender-Default-Definitions
WorkFolders-Client
HypervisorPlatform
VirtualMachinePlatform
Client-ProjFS
Containers-DisposableClientVM
Microsoft-Hyper-V-All
Microsoft-Hyper-V
Microsoft-Hyper-V-Tools-All
Microsoft-Hyper-V-Management-PowerShell
Microsoft-Hyper-V-Hypervisor
Microsoft-Hyper-V-Services
Microsoft-Hyper-V-Management-Clients
Client-DeviceLockdown
Client-EmbeddedShellLauncher
Client-EmbeddedBootExp
Client-EmbeddedLogon
Client-KeyboardFilter
Client-UnifiedWriteFilter
DirectoryServices-ADAM-Client
Windows-Defender-ApplicationGuard
ServicesForNFS-ClientOnly
ClientForNFS-Infrastructure
NFS-Administration
Containers
SMB1Protocol
SMB1Protocol-Client
SMB1Protocol-Server
SMB1Protocol-Deprecation

Command Prompt (I can use PowerShell, but cmd is simpler and I can just double click a .bat file to run them...):

for /f "delims=" %%i in (%CD%\WindowsFeaturesToBeDisabled.txt) do (
  echo %%i
  dism /online /disable-feature /featurename:%%i
)
for /f "delims=" %%i in (%CD%\WindowsServicesToBeDisabled.txt) do (
  echo %%i
  sc config %%i start=disabled
)
reg add HKLM\SYSTEM\CurrentControlSet\Services\BluetoothUserService_1bb7a33 /v Start /t REG_dword /d 4 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc_1bb7a33 /v Start /t REG_dword /d 4 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\ConsentUxUserSvc_1bb7a33 /v Start /t REG_dword /d 4 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc_1bb7a33 /v Start /t REG_dword /d 4 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_1bb7a33 /v Start /t REG_dword /d 4 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\wscsvc /v Start /t REG_dword /d 3 /f
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments /v SaveZoneInformation /t REG_dword /d 00000001 /f
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v LowRiskFileTypes /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;" /f
REG delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /f
REG ADD "HKCU\Environment" /V SEE_MASK_NOZONECHECKS /T REG_SZ /D 1 /F
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /V SEE_MASK_NOZONECHECKS /T REG_SZ /D 1 /F

To date I haven't found a way to directly modify group policy settings and modifying the registry does not change what is set in gpedit.msc, so I will just list the I changes made:

\Windows Components\Autoplay Policies     disabled
\Windows Components\Biometrics     disabled
*SmartScreen  all Turned off
\Windows Components\OneDrive     disabled
\Windows Components\Search     all disabled
\Windows Components\Sync your settings     all "Do not sync" enabled
\Windows Components\Windows Mobility Center     turned off

Now did I disable anything that is absolutely necessary to Windows. Without it, will Windows become unstable, behave erratically and even shut down instantly, or will it cause Windows to freeze randomly and become completely unresponsive every 6 hours or so or cause Windows Settings to detect a stack-based buffer overrun and crash or be unable to run all UWP appx'es? What have I done wrong...

Update: Now I have finally remembered! The memory just suddenly struck after evading me for so long... Now I can confirm none of the problems stemmed from my modifying of the system. I googled every one of them and made sure I don't need them, and my system was fine without them...

No, all of these came shortly after I interrupted running Windows Update, because it auto-updated without my consent or even knowledge, and Windows Module Installer Worker used 50% of the HDD (I have an external 2 TB HDD), hundreds of mebibytes RAM, 33% CPU and slows down my PC horribly, and it just kept running...

So I killed it; I stopped WMIW (TiWorker.exe)... I said to myself it was fine, everything is going to be OK... But it's then when the system went south... Now I don't understand. Why can't DISM and SFC fix the failed Windows Update?

Update: Someone wanted to know the exact make of my computer, though I would like to value my privacy and I personally think it's irrelevant. I will post my computer's system specification below (in pictures, because pictures say more than words):

And about storage:

Answer 1

Don't waste your time disabling services. It will only make it crawl a tiny bit faster at the cost of reliability, security and ease of use. Default configuration is fine.

You need more RAM. 4 GB is just not enough these days and you're sharing it with iGPU. With less than 4 GB of RAM the system will heavily rely on paging which is will slow everything down.

Your motherboard is using DDR3 memory in laptop form factor (SODIMM). Add extra 4 GB to get dual channel working for extra performance.

Your current memory module is DDR3 (not DDR3L) and so should be the other one. The current one is capable of working at 1600 MHz, but the motherboard limits it to 1333 MHz, so no need to pay extra for more than that (it won't hurt to have a faster one though, you just won't benefit from it but resell value may be higher). Price of such module is about $12 where I live if you're fine with buying used parts.

Regarding Defender, it gets auto-disabled when another AV is installed, so it's either already disabled or you don't have better software that does the same thing.

I really am an expert so I wouldn't let virus and malware go through me

Experts know they can't trust themselves 100%. They use real-time AV scanners, unless they're considered a risk in their model. For most of them they're not. You're not a security professional, so you definitely should be using an AV.

Answer 2

If you have access to the licensing for it, I would suggest trying out the LTSC releases of Windows 10. It ships without a lot of the extra cruft that Windows 10 base and Pro come with.

You will lose access to the Store, and any Store apps; Cortana; the new Edge; and modern apps. It will be stripped down, similar to how Windows 7 acted.

Answer 3

You are severely short on RAM, and no amount of disabling things is going to fix that. 64-bit Windows needs (since at least Windows 7) a minimum of 8 GB to run smoothly, but better yet 16GB. The fact that you have an iGPU is compounding this, because that’s eating a chunk of your RAM as well. The only way to make this system run more reliably is to give it more RAM.

---

That aside, as far as disabling services, unless:

• You are 100% certain what a service does.
• You are 100% certain that you know you do not need it.
• You are 100% certain that nothing you do need needs it.

Simply don’t disable it. There are too many interdependencies to keep track of, and you will generally not get good support if you’re using a significantly different configuration for enabled services than the default.

As far as features, most can safely be turned off on most systems, but you should do them one at a time and test that nothing breaks. Some software enables certain features on install because it actually needs them, and that may break if you go around disabling them.

As far as the registry and/or GPO, you should not go mucking about there unless you know exactly what you are doing. It’s way too easy to break your system completely, and it’s actually pretty rare that ‘registry issues’ are in fact causing problems (easy test, back up all your user data, wipe the system, and do a clean install, if that runs no better than it wasn’t registry issues, and if it does then you just fixed all your registry issues).

---

As an aside, this comment:

I don't use any human interface devices

Is false if you are using any USB-connected keyboard, mouse, gamepad, or other input devices, and may be false depending on what other USB devices you use (a lot of things use the HID protocol, even if they aren’t input devices).

Answer 4

So, 1, Can I disable Windows Defender?

Generally, this is not recommended, unless you work completely offline and have configured Windows to run only whitelisted executables with known hash sums. However, you could disable real-time cloud-based protection, as a compromise between performance and security.

Windows Defender has become really good enough in recent years, and it's more than 'just AV', because nowadays it incorporates EMET, allows to manage things like Core isolation etc...

Being a power user who does not start e-mailed exes or other suspicious stuff does not mean that you will be able to withstand something like 0-day exploit, embedded in a legitimate website with XSS. An AV, however, may detect an unusual process that was started in background, and block it. Ex-EMET functionality in Defender will somehow decrease attack surface in that case even more.

2, Can I disable Windows Search? Is it really necessary?

Yes, you can disable it, if you don't use it. And Cortana can be safely disabled too. In gpedit.msc, go to Computer Configuration > Administrative Templates > Windows Components > Search.

3, What exactly is System Guard Runtime Monitor Broker? 4, About Sysmain, what exactly does it do?

Leave them on. I've nothing to add to @djdomi answer.

5, And here are some services I don't know what the hell they are about and/or not sure if it's good to disable them:

Generally, don't disable anything unknown. For instance, if you turn off Encrypted File System, you could lose access to all EFS-protected stuff etc. The only thing I suggest to turn off is IIS Admin, however, this is OK if only none of your apps uses IIS for internal purposes.

---

Offtop: installing a SSD (if you don't have one) may hugely impact performance, especially on older machines (it may feel like I've bought a new PC. Definitely, it will not make the CPU to compute faster but the overall everyday use experience greatly depends on random disk access speed).

It's only my guess, but the performance decrease after rollback may be caused by filesystem fragmentation and re-indexing (as well as by many other causes). I would definitely vote for an OS reinstall.

Answer 5

Being a Windows user/admin since 1995, I can tell you a lot. To keep it simple:

It makes my Windows run faster and better after tweaking it?

Yes, but if you disable one single option erroneously, it may do exactly the opposite of what you expect.

So what should I do?

Study every Windows component, their origin, where they have been since then, their future integrations, their adaptations, and read Windows API occasionally.

Why?

Don't be lazy. So you know what to do next time. Besides understanding the OS and it is an OS after all. Just like Linux, it constantly changes. So, you better know what modifications they've made.

Is it my option right? Is it going to break something? Is it necessary?

Just because you don't use one single service, it doesn't necessarily mean your OS, internet browser or any other application doesn't need it. Yes indeed most of the options you mentioned will stop your system from working fine, except for Cortana (since my last update tweaked it in the last 2018), and some other options can have it disabled.

So where can I know more about what can be disabled or not?

My best recommendation: www.blackviper.com

How to use it and for whom is it intended (this website)?

There're instructions, a table, Windows version, and a note on the right explaining what it does, and it's well instructed. I believe this website was intended for gamers to have maximum performance without harming the OS.

But the website owner says "it's no longer updated"?

It's not the first time he says that and I bet he isn't sure about continuing with this website. However, it has been updated since ever. And besides, the info isn't irresponsible.

Endnotes:

My best advice is to reinstall your OS. Check hardware. Also, in rare cases, it could've been that you got hacked with very intelligent types of malware that remain in the boot, RAM, kernel, or malicious software that modifies your original Windows installation, so it replicates again. It's not normal or acceptable that the OS runs so slow for no reason. Also, consider upgrading your RAM to a minimum of 8GB.

About Windows Defender, it only annoys PUP, it uses the minimum resources possible, and most importantly, Microsoft has a constantly updated of potential viruses that can jeopardize your Windows quickly. This list only has Windows Defender, not other AVs.

About Windows Index, Windows Search was designated to speed up considerably how Windows find and indexes files, not only you but some other of your programs need it too. Linux and every other OS have a variant of this.

Answer 6

The only way to get a smooth, reliable Windows experience is to tinker with the system as little as possible and to just let it do its job (as defined by Microsoft). Windows is just not designed to be heavily customized.

Just think about the time you invested trying to get Windows to do what you want, versus the tiny amount of time you saved because Windows might have been just slightly more responsive.

That means:

• Don't disable any services or apps. You can remove shortcuts and set your favorite programs as defaults. Then forget they are there, until some other program or feature depends on them (maybe without you even noticing).
• In particular, just let Windows Defender do it's job - the benefit of antivirus programs is disputed, but Windows Defender is one of the best there is and won't get in your way.
• Install only as few programs as possible. If a program promises to make Windows better in general ways, don't install it, it's a lie.
• Keep your data off your main Windows partition and properly backed up. Whenver there is any problem, just reinstall Windows.
• If you can install more RAM - do it. But Microsoft currently (end of 2020) sells new "Surface" devices with 4GB of RAM, so any claims that this isn't enough just can't be true.

If you want to tinker, install a virtual machine. Or maybe tinker in Linux in a Linux Subsystem For Windows container - skills digging around in the insides of Linux are much more in demand on the job market.

Answer 7

I am sorry I can't comment right now, so however I give my best to do an answer right now:

1. No, Windows Defender is the most Important and less resources Taken Service that I know - and I ran also a system that has only an AMD APU with about 1.2Ghz and 4 GB ram

2. Windows Search does do a nice job without hassling the hardware. Yes, Some Apps need it and some not - its on your side of decision

3. It's a Part of Windows Defender and should usually not touch'ed

4. It's a part of SuperFetch and may be disabled if you like so

5. You may disable some kind of services, but you should look here