How to modify services in Windows 11: full control, security, and performance

Manage services in Windows 11 It's one of those tasks that you should master if you want to improve your computer's stability, privacy, and performance. While they may sound like something "server-related," they're crucial on the desktop: many system components and applications depend on them, and Touching what you shouldn't can break key functionsHere you have a complete, clear and practical guide to see, understand and modify services Safely.

En particular, Windows 10/11 introduced "per-user services," which are created at logon and deleted at logoff. They operate in the context of your account, are based on Registry templates, and support management via GPOs, security templates, and scripts. We will see what they are, how to list them and how to change their startup with GUI, PowerShell, CMD, GPO and Registry, as well as a detailed list of services per user and specific recommendations.

What are services per user and why do they matter?

When you log in, Windows generates instances of certain services exclusively for your account, and stops and kills them when you log out. Unlike “global” services, these run in the context of your user, which improves isolation and resource management; They cease to exist outside your session and do not run with system identities..

Creation is based on templates located in the Registry, under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. If you adjust the template (for example, setting its startup to Disabled), Windows will still create the instance, but it will be stopped and locked when launched. It is an effective way to control the behavior of certain features on a per-user basis. without removing system dependencies.

These services appear with a name in the format “ServiceName_LUID,” where LUID is a unique local identifier for your session. It’s common to see names like “Contact Data_443f50,” “Sync Host_443f50,” “User Data Access_443f50,” or “User Data Storage_443f50.” The fact that they have a suffix is ​​not a mistake: it indicates that they are per user..

To check them, you can use services.msc (you only see those of your session) —if necessary, reset the services.msc console—, PowerShell, or the command line commands with sc.exe. A key detail: the 64th bit in the ServiceType property identifies the service as a per-user type. That flag allows you to quickly filter them out with a script.

# PowerShell: localizar servicios por usuario (bit 64 en ServiceType)
$flag = 64
$serviceList = @()
$services = Get-Service
foreach ($service in $services) {
    if (($service.ServiceType -band $flag) -eq $flag) {
        $serviceList += $service
    }
}
$serviceList | Sort-Object DisplayName | Format-Table DisplayName, Name, StartType, ServiceType

From CMD, you can check whether an entry is a template or an instance with sc qc. For example, for Game DVR and Broadcast User Service: The template is “BcastDVRUserService” and the per-user instance adds a suffix.

sc qc BcastDVRUserService
sc qc BcastDVRUserService_18f113

List and function of the main services per user

Before disabling or delaying services, understand their impact. Many apps They depend on them: if they stop, certain functions stop working. Below is a summary of the per-user services listed in the current version of Windows, including their name, internal name, default startup type, dependencies (if any), and their purpose. The service names do not change; the rest is a practical summary..

• Agent Activation Runtime (AarSvc): Manual start. Allows activation of conversational agent applications. Unspecified dependencies. Useful for modern interaction scenarios. If you remove it, certain agent experiences may fail..
• Bluetooth User Support Service (BluetoothUserService): Manual start. Manages Bluetooth features per user session. No dependencies listed. Key if you use BT peripherals with user functions.
• OneCore Capture Service (CaptureService): Manual start. Enables screenshot capture using the Windows.Graphics.Capture API. No dependencies. If you stop it, capturing in UWP apps may not work..
• User Service Clipboard (cbdhsvc): Automatic start (delayed start). Manages history and clipboard synchronization between devices. Disabling it breaks history and sync.
• Cloud Backup and Restore (CloudBackupRestoreSvc): Manual start. Monitors changes in app status and settings, performing cloud backups and restores when appropriate. Useful for recovering app states.
• Connected Devices Platform User Service (CDPUserSvc): Automatic startup. Depends on Network Connection Broker, RPC, and TCP/IP. Connects, manages, and controls nearby devices (mobile, Xbox, HoloLens, IoT). Required for “Nearby Sharing”.
• ConsentUxUserSvc: Manual start. Orchestrates user consent for apps to access sensitive resources (e.g., location). Without it, permit applications may fail..
• Contact information (PimIndexMaintenanceSvc): Manual start. Depends on UnistoreSvc. Indexes contacts for fast searches; without it, contacts will be missing from the results. Relevant if you use Contacts/Mail.
• CredentialEnrollmentManagerUserSvc: Manual start. Supports storage and secure credential recovery (web tokens, RDP, etc.). Disabling it may break app and RDP logins..
• DeviceAssociationBrokerSvc: Manual start. Depends on DevicePicker and Shell's pairing experience. Facilitates in-app pairing and access checks for new devices. Impacts BT/Miracast pairings.
• DevicePickerUserSvc: Manual start. Manages Miracast, DLNA, and DIAL experiences. Essential for network projection/broadcasting.
• DevicesFlowUserSvc: Manual start. Allows the UI and Settings app to pair Wi-Fi displays and BT devices. Interferes with “Connect” if disabled.
• BcastDVRUserService: : Manual start. Game recording and streaming. If you record gameplay with Game Bar, don't disable it..
• MessagingService: Manual start. Supports text messaging and related features. It only impacts apps that use it.
• NPSMSvc (Session Manager Replay): Manual start. Manages running multimedia sessions. May affect audiovisual experiences (solution for unresponsive audio services).
• P9RdrService (Plan 9 Redirector): Manual start. Enables Plan 9 file servers for WSL. If you are not using WSL/Plan 9, you can leave it on manual.
• PenService: Manual start. Responds to pen button actions (opening apps or configured actions). Essential for pencil-based equipment.
• PrintWorkflowUserSvc: Manual start. Support for print workflow apps; some printing functions fail without it. Do not disable it if you print.
• OneSyncSvc (Sync Host): Automatic start (delayed start). No dependencies listed. Syncs email, contacts, calendar, and other data; if stopped, dependent apps will crash. Critical for Outlook/Mail.
• UdkUserSvc: : Manual start. Coordinates shell experiences. Generally harmless in manual.
• UserDataSvc (User Data Access): Manual start. Depends on UnistoreSvc. Provides apps with access to contacts, calendars, and messages; if it fails, apps may crash. Key for PIM apps.
• UnistoreSvc (User Data Storage): Manual start. Manages the storage of contacts, calendar, messages, and other structured data. Base for UserDataSvc and PIM.
• webthreatdefusersvc (Web Threat Defense User Service): Automatic start. Warns when unauthorized entities attempt to access credentials. Relevant for security.
• WpnUserService: Automatic startup. Hosts the WNS platform for local and push notifications (icon, system, and raw). Essential for modern notifications.

Please note that some versions of Windows 10/11 may not include the exact same list or default startup. Always check your system before applying massive changes.

How to view and audit services by user

From the Services console (services.msc), you'll see the services for your session with the suffix "_LUID." Run services.msc from Start or with Win+R, type services.msc, and press Enter. It is the fastest way to check startup states and types without using the console.

In PowerShell, in addition to the flag 64 script, you can list all events using Get-Service, or filter by display or internal name. To locate the Windows Event Collector by display name: Rely on wildcards with the asterisk for flexible searches.

# Búsqueda por nombre visible
Get-Service -DisplayName "Recopilador*"

In CMD, sc qc allows you to query the “Type” and other parameters to distinguish between templates and instances. If you compare “BcastDVRUserService” with “BcastDVRUserService_XXXXXX,” you'll see subtle differences that tell you what's a template and what's an instance. Use suffixes to avoid confusion.For more commands and examples on how to automate process and service control, see Control processes and services with taskkill and sc.

As a debugging trick, you can temporarily stop a service per user from the console, but that state is volatile: upon restart, it will revert to its default startup configuration. For persistent changes, adjust the “Startup type” in Properties or use PowerShell/Registry.

Disable or change startup: GPO, Registry, and scripts

Per-user service templates don't appear in services.msc, so you'll need to work with them via Group Policy (GPO), Security Templates, GPO Preferences, or scripts that edit the Registry. The templates reside in HKLM\SYSTEM\CurrentControlSet\Services\.

Not all of them support management using the services template in classic policies. And there are four that you can't touch with the security template: PimIndexMaintenanceSvc, UnistoreSvc, UserDataSvc, and WpnUserService. For them, use GPO Preferences or scripts..

Possible strategies: combining a security template and a Registry Preferences script; using only GPO Preferences; or scripts deployed with Configuration Manager or similar. Choose the one that best suits your park and permits.

Security templates (examples for CDPUserSvc and OneSyncSvc). This type of .inf file defines service settings; startup can be set in the services section. Use it with SecEdit or during hardening.

Unicode=yes

signature="$CHICAGO$"
Revision=1

"CDPUserSVC".4,""

PowerShell scripts. For example, setting PimIndexMaintenanceSvc startup to Disabled: Set-Service makes changing StartupType much easier..

Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled

With sc.exe. Note: the correct command is "config" (sometimes you'll see "configure" by mistake). The syntax requires a space after start=.

sc.exe config PimIndexMaintenanceSvc start= disabled

GPO preferences to edit the Registry: Create a GPO, go to Computer or User Configuration > Preferences > Windows Settings > Registry, add a new item, and point it to HKLM\System\CurrentControlSet\Services\ Start value, changing its data to 4 (Disabled). Repeat for each service you want to control..

# Ejemplo con REG.EXE para varios servicios clave
REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f

If you want to prevent user-based instance creation at login, set UserServiceFlags to 0 in the service template. It is a strong blockade that should be tested first in the laboratory..

REG.EXE ADD HKLM\System\CurrentControlSet\Services\<Servicio> /v UserServiceFlags /t REG_DWORD /d 0 /f

Services Panel: Access, Basic Changes, and Precautions

Windows provides a graphical interface for managing services. You can get there from Start by searching for “Services,” from Windows Tools, or from the Task Manager, Services tab, with “Open services”. The classic route with Win+R and services.msc is still the most direct.

You'll see a list with its name, description, status, startup type, and account. Right-click on a service and you'll see Start, Stop, Pause, Resume, Restart, Update, Properties, and Help. For lasting changes, go to Properties and adjust “Startup Type”.

Startup types: Automatic (boots with the system), Automatic (delayed start) (starts after boot, ideal for secondary services), Manual (on demand only), and Disabled (does not start). If you stop a service without changing its type, it will return to its configured state after restart..

Before you experiment, create a restore point (or see how to restore deleted or damaged services), use a VM or secondary computer. Touching critical services can prevent logins, disrupt the network, or disable security. If you are not sure, it is better not to disable it..

PowerShell and CMD: Fine-grained and fast service control

PowerShell lets you quickly list, filter, and change states. After locating the internal name (Name), you can stop, start, suspend, or restart. Remember to run the console as administrator for system changes..

# Parar
Stop-Service -Name Wecsvc
# Iniciar
Start-Service -Name Wecsvc
# Suspender (si lo admite)
Suspend-Service -Name Wecsvc
# Reiniciar
Restart-Service -Name Wecsvc

To modify the Boot from the next startup: Set-Service -StartupType. Typical values: Automatic, AutomaticDelayedStart, Manual, Disabled. Use it together with Stop-Service if you want to stop and block at the same time..

# Deshabilitar para el siguiente arranque
Set-Service -Name Wecsvc -StartupType Disabled
# Parar y forzar
Stop-Service -Name Wecsvc -Force
# Volver a automático y dejarlo ejecutándose
Set-Service -Name Wecsvc -Status Running -StartupType Automatic

With sc.exe, in addition to querying (sc qc), you can adjust the startup: Don’t forget the space after “start=”. To query templates and instances, use sc qc Name and sc qc Name_LUID.

# Consultar
sc qc BcastDVRUserService
sc qc BcastDVRUserService_18f113
# Configurar inicio
sc.exe config PimIndexMaintenanceSvc start= disabled

Recommended network services for My Cloud and similar devices

If you're using storage like My Cloud OS 5 or My Cloud Home, it's a good idea to keep certain network services running and starting automatically. This makes discovery, sharing, and connections easier. Check that they are active after hardening changes.

• Team Navigator
• DHCP Client
• DNS client
• Publishing Feature Discovery Resources
• Network location awareness
• Plug and Play
• SSDP discovery
• Storage server
• employee
• TCP/IP NetBIOS Helper
• UPnP Host Device
• Work station

To adjust them from the Services console: select the service, select Properties, change "Startup type" to Automatic, and then click Apply. If it's stopped, click Start. Restart the computer to validate that they persist.

Repair Microsoft Store and check associated services

For issues with the Microsoft Store, you can re-register the AppX package. The exact path varies depending on the installed version, so first list the folders under C:\Program Files\WindowsApps and locate the one that begins with “Microsoft.WindowsStore…”. Run PowerShell as administrator to avoid permission errors.

# Listar carpetas de WindowsApps
Get-ChildItem -Path "C:\\Program Files\\WindowsApps"
# Registrar Microsoft Store (sustituye por tu ruta exacta)
Add-AppxPackage -DisableDevelopmentMode -Register "C:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_22404.1401.2.0_x64__8wekyb3d8bbwe\\AppxManifest.xml"

Also check the services: “Client Licensing Service (ClipSVC)” and “AppX Deployment Service (AppXSVC)”. If they are stopped or disabled, Store may crash.

Install and uninstall Windows services (for developers)

If you're developing a service using the .NET Framework, you can install it using InstallUtil.exe or PowerShell. First, add the service installer to your project in Visual Studio. Note that it does not run with F5; you have to install it first..

With InstallUtil.exe (from the Symbol of the system (for Visual Studio developers): Go to the compiled executable folder and run the tool by passing the project .exe. InstallUtil is located in %WINDIR%\Microsoft.NET\Framework\\ . If not in PATH, use the full path.

# Instalar
installutil <tuProyecto>.exe
# Desinstalar
installutil /uninstall <tuProyecto>.exe
# Si queda rastro, borra la entrada del servicio
sc.exe delete "YourServiceName"

With PowerShell: To create the service, use New-Service, specifying the name and binary path; to remove it, use Remove-Service by name. If the executable no longer exists but the key remains, “sc delete” cleans the Registry. Run the console elevated to avoid denials.

# Crear
New-Service -Name "YourServiceName" -BinaryPathName <tuProyecto>.exe
# Eliminar
Remove-Service -Name "YourServiceName"
# Limpieza en Registro si hiciera falta
sc.exe delete "YourServiceName"

Services run with elevated permissions and can start in the background. That's why Windows requires administrator privileges for their installation and configuration changes. Always validate the security context in the “Log On” tab of the Properties and, if you need to audit permits, Use accesschk in Windows.

Managing services in Windows 11 isn't about randomly disabling services, but rather about understanding dependencies, user context, and security objectives. With the Services console for quick tweaks, PowerShell and CMD for automation, and GPO/Registry for persistent policies, you can fine-tune your system: Disable what is superfluous, preserve what is critical (notifications, PIM, security) and document every changeThis way, you'll have a more agile and predictable team without sacrificing key features.