Remove unnecessary services and bloatware of WIndows 10 operating system

This article presents many Windows 10 services/bloatware and recommendations to safely remove them (or not). You will learn how to list and remove Windows 10 bloatware.

Summary

[I] General presentation

*What are Windows services

All the important components and features for the good functioning of your Windows Operating System (for instance Windows 10) are made available to the end user through system services. Those services are making your system running smoothly with a lot of features making it very efficient in various situation.

*What is a bloatware

A software bloat (or bloatware) is a process making a system slower, use more memory, disk space or processing power, or have higher hardware requirements than its vanilla version, while making only minor user-perceptible improvements or even suffering from failures.

The term is often used to describe undesired features or changes, even if they have little or no effect on the system. Most end users will feel they only need some limited subset of the available functions in an operating system, and will consider others as unnecessary bloat (it is probably the case), even if different users with different configurations require those functions. .

*Why disabling unnecessary services and bloatware

You can disable unnecessary service in Windows 10 to improve your computer performance, security and system minimization. Moreover, some services may gives unexpected behaviors not explicitly requested by their system usage.

By default, the Microsoft Windows operating system embeds many components and functionalities which are not necessary for the good functioning of the system.

[II] Managing Windows 10 services

*Listing services

There are multiple ways to list Windows Services. An obvious one is by using the built-in GUI 'services.msc' into the Windows task bar. However, its is not very practical regarding system administration.

An other way (preferred by us) is by using the command-line prompt and the powershell toolkit...

Open a Windows Elevated BATCH command-line prompt (cmd as admin).

Typing the following command will gives you a list of all Windows Services including their status (Stopped or Running).

C:>
powershell -c Get-Service

Note the 2 distinct columns "Name" and "DisplayName". The "Display Name" is the usual name of the service that you may find reading the 'services.msc' GUI while the "Name" is the real "system" name of the related service.

The services listed in this article are named according to their "Name" (and not their "DisplayName").

With the following command, you will be able to list the "running" services

C:>
powershell -c "Get-Service | Where-Object {$_.Status -eq 'Running'}"

For the ease of display, you may also want to only display the name of running services. This may be easily done with the following command:

C:>
powershell -c "Get-Service | Where-Object {$_.Status -eq 'Running'} |Select -Property Name"

*Stopping a service

The following command will force the stop of a service

C:>
powershell -c "Get-Service -Name service* | Stop-Service -Force"

*Disabling a service

There are multiple ways to disable a service. However, disabling a bloatware may sometime become a touchy task due to permission issues, and this is why we also provide an « hard way » to force the disabling of a service.

Disable a service (soft way) :

C:>
powershell -c "Get-Service -Name service* | Set-Service -StartupType Disabled"

Disable a service (alternative way) :

C:>
powershell -c "sc config Service start=disabled"

When both previous commands fail to disable a service, you may also try to disable a service directly from the system registry. For this purpose, we will go through the powershell cmdline.

Disable a service by registry (the hard way) :

C:>
powershell -executionpolicy Bypass
PS C:>
Set-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service*" -Name Start -Value 4

[III] List of bloatware to remove/disable

The following table list some identified windows service, their description, and our recommendation to remove/disable them or not for removing bloatware while keeping the good functonning of the system.

Use the WinCleanSeckTo Script to automatically clean your system (based on this list).

Last Update: 18/03/2023. The list will be periodicaly updated. Keep watching it.

Service Name	Detail	Recommendation
Appinfo	Win32 services making Windows system operations: launch apps in admin mode, necessary for services modifications, reboot in maintenance mode.	Keep it
AppReadiness	Gets apps ready for use the first time a user signs in to this PC and when adding new apps.	Remove it
AppXSvc	Used for installing, uninstalling, and updating Store apps. Windows automatically updates Store apps in the background, and many of the apps included with Windows. Disable only if you dont use Microsoft Store apps.	Check description
AudioEndpointBuilder	Manages audio devices for the Windows Audio service. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.	Keep it
Audiosrv	Manages audio for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.	Keep it
BcastDVRUserService	The Broadcast DVR server process is associated with Windows 10’s Game DVR feature. If you use Game DVR to record your PC gameplay or broadcast it online, the bcastdvr.exe process does the work. If you don’t use Game DVR for recording, this process sits silently in the background and does nothing.	Remove it
BFE	The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications.	Keep it
BrokerInfrastructure	Windows infrastructure service that controls which background tasks can run on the system.	Keep it
BthAvctpSvc	AVCTP service is a Win32 service. In Windows 10 it is starting only if the user, an application or another service starts it. When the AVCTP service is started, it is running as NT AUTHORITY\LocalService in a shared process of svchost.exe along with other services. If AVCTP service fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the BthAvctpSvc service has failed to start due to the error. Remove it if you don’t use Bluetooth Audio Device or Wireless Headphones	Remove it
camSvc	Provides facilities for managing UWP apps access to app capabilities as well as checking an app's access to specific app capabilities.The CAMService.exe file is not a Windows core file.	Remove it
cbdhsvc	This user service is used for Clipboard scenarios.	Remove it
CDPSvc	This service is used for Connected Devices Platform scenarios. There is a conflict in users’ statements regarding this question. Some users that disabled the service went on to use their computers without any issues or side effects. However, some users have reported that they encountered some problems while connecting certain devices with the computer. Therefore, it is our recommendation that if you don’t use Xbox Live or any other Bluetooth devices with the computer regularly, you should disable the service.	Remove it
CDPUserSvc	if you don’t use Xbox Live or any other Bluetooth devices with the computer regularly, you should disable the service.	Remove it
ClipSVC	Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave correctly. Disable only if you dont use Microsoft Store apps.	Check description
CmService	is not a Windows core file. Safe to remove.	Remove it
CoreMessagingRegistrar	Manages communication between system components. is a basic system component. Highly unsafe to remove.	Keep it
cphs	IntelCpHeciSvc.exe is not essential for the Windows OS and causes relatively few problems. Embedded in a number of computers with Intel chips starting with second generation core processors. This file is part of "Intel Insider" and is involved in communication with something concerning content protection. This program is centered primarily on HDMI films etc. If you do not view such DRM protected content, you can disable this service.	Remove it
cplspcon	Disable these if you don't use digitally protected video. May affect Netflix or streaming services.	Remove it
CryptSvc	Provides three management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from your computer; and Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update and enable scenarios such as SSL. If this service is stopped, these management services will not function properly.	Keep it
DcomLaunch	The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running.	Keep it
DeviceAssociationService	Enables pairing between the system and wired or wireless devices.	Remove it
Dhcp	Registers and updates IP addresses and DNS records for your computer. If this service is stopped, your computer will not receive dynamic IP addresses and DNS updates	Keep it
DiagTrack	The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event driven collection and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled under Feedback and Diagnostics.	Remove it
DispBrokerDesktopSvc	Manages the connection and configuration of local and remote displays.	Keep it
Dnscache	The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for your computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start.	Keep it
DoSvc	Performs content delivery optimization tasks. Delivery Optimization is a peer-to-peer client update service that uses PCs, both local PCs and non-local devices via the Internet, to deliver updated Windows 10 bits to an organization's networked PCs.	Remove it
DPS	The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function.	Remove it
DusmSvc	Network data usage, data limit, restrict background data, metered networks	Remove it
EventLog	This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system.	Keep it
EventSystem	Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications.	Keep it
fdPHost	The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services Discovery (WS-D) protocol. Stopping or disabling the FDPHOST service will disable network discovery for these protocols when using FD.	Remove it
FDResPub	Publishes your computer and resources attached to your computer so they can be discovered over the network. If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network.	Remove it
FontCache	ptimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade application performance	Keep it
gpsvc	Responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is disabled, the settings will not be applied and applications and components will not be manageable through Group Policy.	Keep it
hns	The Host Networking Service (HNS) and the Host Compute Service (HCS) work together to create containers and attach endpoints to a network.	Remove it
iphlpsvc	Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer. Remove if If you don't use IPv6.	Remove it
KeyIso	The CNG key isolation service is hosted in the LSA process. The service provides key process isolation to private keys and associated cryptographic operations as required by the Common Criteria. The service stores and uses long-lived keys in a secure process complying with Common Criteria requirements	Keep it
LanmanServer	Allows to share files and printers with other devices on your network. It is safe to disable it but File sharing will not work, sharing controls will disappear from File Explorer, remote printing will not work.	Check description
LanmanWorkstation	Creates and maintains client network connections to remote servers using the SMB protocol. Allows a client to request file and print resources from servers over the network. Disabling it will keep the system frm discovering network shared resources.	Check description
lfsvc	Geolocation service monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences.	Remove it
LicenseManager	Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then content acquired through the Microsoft Store will not function properly.	Check description
lmhosts	Supports NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, allowing users to share files, print, and log on to the network. If this service is stopped, these functions may not be available. If this service is disabled, the system wil not be able to use the Workgroup feature. Turn off if the system is not on a Workgroup.	Check description
LSM	Core Windows Service that manages local user sessions.	Keep it
mpssvc	Windows Defender Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.	Keep it
NcbService	Brokers connections that allow Windows Store Apps to receive notifications from the internet.	Remove it
NcdAutoSetup	This feature affects the way Windows 10 and Windows 8.1 work with network devices like external hard drives that are connected to the router or to another computer in the network. Such devices can be used by features like File History. This tool can detect hard disks that are attached to other network PCs or devices and use them for backing up your personal files and folders. If you prefer to manually install network devices, disable this.	Remove it
netprofm	Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.	Keep it
NlaSvc	Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable.	Keep it
nsi	This service delivers network notifications (e.g. interface addition/deleting etc) to user mode clients. Stopping this service will cause loss of network connectivity.	Keep it
OneSyncSvc	Synchronizes mail, contacts, calendar, and other user data. Mail and other applications dependent on this service don't work correctly when this service isn't running.	Remove it
PcaSvc	This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. If this service is stopped, PCA will not function properly. Disable if you dont need to run software in Compatibility mode	Remove it
PlugPlay	Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.	Keep it
Power	Manages power policy and power policy notification delivery.	Keep it
ProfSvc	Responsible for loading and unloading user profiles — collections of settings and information associated with each Windows account. If this service is stopped or disabled, users will no longer be able to successfully sign in or sign out, apps might have problems getting to users' data, and components registered to receive profile event notifications won't receive them.	Keep it
RasMan	Manages dial-up and virtual private network (VPN) connections from your computer to the Internet or other remote networks. If this service is disabled, any services that explicitly depend on it will fail to start. If the Remote Access Connection Manager service stops or if you disable it, the computer cannot make dial-up or VPN connections to a remote network or accept inbound connection requests. Also, the Network Connections folder does not display any VPN or dial-up connections, and the Internet Options Control Panel does not allow the user to configure any options that pertain to dial-up or VPN connections	Remove it
RmSvc	Radio Management and Airplane Mode Service.	Remove it
RpcEptMapper	Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function properly. If this service is not available, the operating system does not load.	Keep it
RpcSs	Service Control Manager for COM and DCOM servers. It performs object activations requests, object exporter resolutions and distributed garbage collection for COM and DCOM servers. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the RPCSS service running.	Keep it
SamSs	The Security Accounts Manager service administers the database of user and group account information stored on your computer. The service helps to authenticate local and remote users logging on to your PC. This service should not be disabled.	Keep it
Schedule	Task scheduler.Enables a user to configure and schedule automated tasks on your computer. The service also hosts multiple Windows system-critical tasks. If this service is stopped or disabled, these tasks will not be run at their scheduled times.	Keep it
SecurityHealthService	Windows Security Service handles unified device protection and health information.	Keep it
SEMgrSvc	Manages payments and Near Field Communication (NFC) based secure elements.	Remove it
SENS	Monitors system events and notifies subscribers to COM+ Event System of these events.	Keep it
SgrmBroker	Monitors and ensures the integrity of the Windows platform.	Keep it
SharedAccess	Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Old service, disabling could cause problems with Internet Explorer	Remove it
ShellHWDetection	Provides notifications for AutoPlay hardware events.AutoPlay is a feature that detects content such as pictures, music, or video files on a removable storage device. AutoPlay then automatically starts applications to play or display that content, which simplifies the use of specialized peripheral devices such as MP3 players and digital photo readers. The service also makes it easier for users because they do not need to know beforehand what software applications are needed to access various content types.	Remove it
Spooler	This service spools print jobs and handles interaction with the printer. If you turn off this service, you won't be able to print or see your printers.	Keep it
SSDPSRV	Discovers networked devices and services that use the SSDP discovery protocol, such as UPnP devices. Also announces SSDP devices and services running on the local computer. If this service is stopped, SSDP-based devices will not be discovered	Remove it
SstpSvc	Provides support for the Secure Socket Tunneling Protocol (SSTP) to connect to remote computers using VPN. If this service is disabled, users will not be able to use SSTP to access remote servers. Disable if you dont need to connect to external VPNs (SSTP based)	Remove it
StateRepository	Provides required infrastructure support for the application model. The service is responsible for rendering browser components used for syncing and restoring the sessions. It stores essential information, like browsing history, DOM (Document Object Model), cookies, sessions, and many more.	Remove it
StorSvc	Provides enabling services for storage settings and external storage expansion.	Remove it
SysMain	The Superfetch (Sysmain) service maintains and improves system performance. The Superfetch service is part of a collection of performance-enhancing features that address responsiveness issues related to demand paging. Disable it on servers but keep it on workstations.	Check description
SystemEventsBroker	Coordinates execution of background work for WinRT application. If this service is stopped or disabled, then background work might not be triggered. Needed for task scheduler, broker infrastructure service, and other internal components.	Keep it
TabletInputService	Active les fonctionnalités de stylet et d’entrée manuscrite du clavier tactile et du volet d’écriture manuscrite. Désactivez si votre ordinateur n’est pas une tablette.	Remove it
Themes	Provides user experience theme management. If the Themes service stops or if you disable it, the visual style (including the windows, buttons, scrollbars, Start button, and other controls) revert to the Windows Classic visual style.	Remove it
TimeBrokerSvc	Coordinates execution of background work for WinRT application. If this service is stopped or disabled, then background work might not be triggered. Needed for task scheduler, broker infrastructure service, and other internal components.	Keep it
TokenBroker	This service is used by Web Account Manager to provide single sign-on to applications and services.	Remove it
TrkWks	Old service that keeps track of NTFS files as they move around on a server	Remove it
Trustedinstaller	Enables installation, modification, and removal of Windows updates and optional components. If this service is disabled, install or uninstall of Windows updates might fail for this computer.	Keep it
UserManager	User Manager provides the runtime components required for multi-user interaction. If this service is stopped, some applications may not operate correctly.	TBD
UsoSvc	Manages Windows Updates. If stopped, your devices will not be able to download and install the latest updates.	Keep it
VaultSvc	Provides secure storage and retrieval of credentials to users, applications and security service packages.	Keep it
Wcmsvc	Makes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC and enables management of network connectivity based on Group Policy settings.	Keep it
WdiServiceHost	The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context. If this service is stopped, any diagnostics that depend on it will no longer function.	Remove it
WdiSystemHost	The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. If this service is stopped, any diagnostics that depend on it will no longer function.	Remove it
WdNisSvc	Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols	Keep it
WinDefend	Helps protect users from malware and other potentially unwanted software	Keep it
WinHttpAutoProxySvc	WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol.	Remove it
WinMgmt	Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.	Remove it
wlidsvc	Enables user sign-in through Microsoft account identity services. If this service is stopped, users will not be able to log on to the computer with their Microsoft account.	Check description
WpnService	This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server.	Remove it
WpnUserService	This service hosts Windows notification platform which provides support for local and push notifications. Supported notifications are tile, toast and raw.	Remove it
wscsvc	The Security Center (wscsvc) service monitors and reports security health settings on the computer. The health settings include whether the firewall is turned on, the current status of the installed antivirus application, the current status of the installed antispyware application, the current Windows Update setting, whether User Account Control is turned on, and whether the recommended Internet settings are in use. If you disable the Security Center service, the protected components continue to function in accordance with their specific configuration settings. However, no centralized monitor service is provided.	Keep it
Wsearch	Fournit des fonctionnalités d’indexation de contenu, de mise en cache des propriétés, de résultats de recherche pour les fichiers, les messages électroniques et autres contenus.	Keep it
wuauserv	Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API.	Keep it

Back