How to modify services in Windows 11: full control, security, and performance

Managing services in Windows 11 is one of those tasks you should master if you want to improve your computer's stability, privacy, and performance. While they might sound like something you'd only do on a server, they're crucial on your desktop: many system components and applications depend on them, and messing with the wrong ones can break key functions . Here's a complete, clear, and practical guide to safely viewing, understanding, and modifying services .

In particular, Windows 10/11 introduced "per-user services," which are created when you log in and deleted when you log out. They operate within the context of your user account, are based on Registry templates, and support management via Group Policy Objects (GPOs), security templates, and scripts. We'll see what they are, how to list them, and how to change their startup sequence using the GUI, PowerShell, Command Prompt (CMD), Group Policy Objects (GPOs), and the Registry , along with a detailed list of per-user services and specific recommendations.

What are services per user and why do they matter?

When you log in, Windows creates instances of certain services exclusively for your account, and stops and terminates them when you log out. Unlike "global" services, these run within your user context, improving isolation and resource management; they cease to exist outside your session and do not run with system identities.

The creation process relies on templates located in the Registry, specifically within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. If you adjust the template (for example, by setting its startup to Disabled), Windows will still create the instance, but it will be launched already stopped and locked. This is an effective way to control the behavior of certain features per user without removing system dependencies.

These services appear with a name in the format “ServiceName_LUID”, where LUID is a unique local identifier for your session. It's common to see names like “Contact Data_443f50”, “Sync Host_443f50”, “User Data Access_443f50”, or “User Data Storage_443f50”. The suffix is ​​not an error; it indicates that they are user-specific.

To view them, you can use services.msc (you'll only see those in your session) —if necessary, reset the services.msc console— , PowerShell, or the command line with sc.exe. A key detail: bit 64 in the ServiceType property identifies the service as per-user. This flag allows you to quickly filter them with a script.

# PowerShell: localizar servicios por usuario (bit 64 en ServiceType)
$flag = 64
$serviceList = @()
$services = Get-Service
foreach ($service in $services) {
    if (($service.ServiceType -band $flag) -eq $flag) {
        $serviceList += $service
    }
}
$serviceList | Sort-Object DisplayName | Format-Table DisplayName, Name, StartType, ServiceType

From CMD you can check if an entry is a template or an instance with sc qc. For example, regarding Game DVR and Broadcast User Service: the template is “BcastDVRUserService” and the user instance adds a suffix.

sc qc BcastDVRUserService
sc qc BcastDVRUserService_18f113

List and function of the main services per user

Before disabling or delaying services, understand their impact. Many apps depend on them: if they stop, certain functions will cease to work. Below is a summary of the per-user services listed in the current version of Windows, including their name, internal name, default startup type, dependencies (if any), and purpose. The service names remain the same; the rest is a practical summary.

• Agent Activation Runtime (AarSvc): Manual start. Allows activation of conversational agent applications. Unspecified dependencies. Useful for modern interaction scenarios. If you remove it, certain agent experiences may fail..
• Bluetooth User Support Service (BluetoothUserService): Manual start. Manages Bluetooth features per user session. No dependencies listed. Key if you use BT peripherals with user functions.
• OneCore Capture Service (CaptureService): Manual start. Enables screenshot capture using the Windows.Graphics.Capture API. No dependencies. If you stop it, capturing in UWP apps may not work..
• User Service Clipboard (cbdhsvc): Automatic start (delayed start). Manages history and clipboard synchronization between devices. Disabling it breaks history and sync.
• Cloud Backup and Restore (CloudBackupRestoreSvc): Manual start. Monitors changes in app status and settings, performing cloud backups and restores when appropriate. Useful for recovering app states.
• Connected Devices Platform User Service (CDPUserSvc): Automatic startup. Depends on Network Connection Broker, RPC, and TCP/IP. Connects, manages, and controls nearby devices (mobile, Xbox, HoloLens, IoT). Required for “Nearby Sharing”.
• ConsentUxUserSvc: Manual start. Orchestrates user consent for apps to access sensitive resources (e.g., location). Without it, permit applications may fail..
• Contact information (PimIndexMaintenanceSvc): Manual start. Depends on UnistoreSvc. Indexes contacts for fast searches; without it, contacts will be missing from the results. Relevant if you use Contacts/Mail.
• CredentialEnrollmentManagerUserSvc: Manual start. Supports storage and secure credential recovery (web tokens, RDP, etc.). Disabling it may break app and RDP logins..
• DeviceAssociationBrokerSvc: Manual start. Depends on DevicePicker and Shell's pairing experience. Facilitates in-app pairing and access checks for new devices. Impacts BT/Miracast pairings.
• DevicePickerUserSvc: Manual start. Manages Miracast, DLNA, and DIAL experiences. Essential for network projection/broadcasting.
• DevicesFlowUserSvc: Manual start. Allows the UI and Settings app to pair Wi-Fi displays and BT devices. Interferes with “Connect” if disabled.
• BcastDVRUserService: : Manual start. Game recording and streaming. If you record gameplay with Game Bar, don't disable it..
• MessagingService: Manual start. Supports text messaging and related features. It only impacts apps that use it.
• NPSMSvc (Session Manager Replay): Manual start. Manages running multimedia sessions. May affect audiovisual experiences (solution for unresponsive audio services).
• P9RdrService (Plan 9 Redirector): Manual start. Enables Plan 9 file servers for WSL. If you are not using WSL/Plan 9, you can leave it on manual.
• PenService: Manual start. Responds to pen button actions (opening apps or configured actions). Essential for pencil-based equipment.
• PrintWorkflowUserSvc: Manual start. Support for print workflow apps; some printing functions fail without it. Do not disable it if you print.
• OneSyncSvc (Sync Host): Automatic start (delayed start). No dependencies listed. Syncs email, contacts, calendar, and other data; if stopped, dependent apps will crash. Critical for Outlook/Mail.
• UdkUserSvc: : Manual start. Coordinates shell experiences. Generally harmless in manual.
• UserDataSvc (User Data Access): Manual start. Depends on UnistoreSvc. Provides apps with access to contacts, calendars, and messages; if it fails, apps may crash. Key for PIM apps.
• UnistoreSvc (User Data Storage): Manual start. Manages the storage of contacts, calendar, messages, and other structured data. Base for UserDataSvc and PIM.
• webthreatdefusersvc (Web Threat Defense User Service): Automatic start. Warns when unauthorized entities attempt to access credentials. Relevant for security.
• WpnUserService: Automatic startup. Hosts the WNS platform for local and push notifications (icon, system, and raw). Essential for modern notifications.

Keep in mind that some versions of Windows 10/11 may not include the exact same list or default startup items. Always check your system before making any major changes.

How to view and audit services by user

From the Services console (services.msc), you'll see the services for your own session with the suffix "_LUID". Run services.msc from the Start menu or by pressing Win+R, typing services.msc, and pressing Enter. This is the fastest way to check startup statuses and types without using the command prompt.

In PowerShell, in addition to the flag 64 script, you can list all services using Get-Service, or filter by public or internal name. To locate the Windows Event Collector by public name, use wildcards with the asterisk for flexible searches.

# Búsqueda por nombre visible
Get-Service -DisplayName "Recopilador*"

In CMD, `sc qc` lets you check the "Type" and other parameters to distinguish between templates and instances. If you compare "BcastDVRUserService" with "BcastDVRUserService_XXXXXX", you'll see subtle differences that tell you which is a template and which is an instance. Use suffixes to avoid confusion . For more commands and examples on how to automate process and service control, see Controlling Processes and Services with `taskkill` and `sc`.

As a troubleshooting trick, you can temporarily stop a service per user from the console, but this state is volatile: upon restarting, it will revert to its default startup configuration. For persistent changes, adjust the "Startup type" in Properties or use PowerShell/Registry.

Disable or change startup: GPO, Registry, and scripts

User service templates are not listed in services.msc, so you'll need to configure them using Group Policy (GPO), security templates, GPO Preferences, or scripts that edit the Registry. These templates are located in HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>.

Not all services support management via service templates in classic policies. And there are four that you can't modify with security templates: PimIndexMaintenanceSvc, UnistoreSvc, UserDataSvc, and WpnUserService. For these, you'll need to use Group Policy Preferences or scripts.

Possible strategies: combine a security template and a script/Registry Preferences; use only GPO Preferences; or scripts deployed with Configuration Manager or similar. Choose the one that best suits your system and permissions.

Security templates (example for CDPUserSvc and OneSyncSvc). This type of .inf file defines service settings; the startup can be configured in the Services section. Use it with SecEdit or during hardening.

Unicode=yes

signature="$CHICAGO$"
Revision=1

"CDPUserSVC".4,""

PowerShell scripts. For example, setting PimIndexMaintenanceSvc startup to Disabled: Set-Service greatly simplifies changing StartupType.

Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled

Using sc.exe. Note: the correct command is "config" (you may sometimes see "configure" by mistake). The syntax requires a space after start=.

sc.exe config PimIndexMaintenanceSvc start= disabled

GPO preferences to edit the Registry: Create a GPO, go to Computer or User Configuration > Preferences > Windows Settings > Registry, add a new item and point to HKLM\System\CurrentControlSet\Services\<Service> Start value, changing its data to 4 (Disabled). Repeat for each service you want to control.

# Ejemplo con REG.EXE para varios servicios clave
REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f

If you want to prevent the creation of instances per user upon login, set UserServiceFlags to 0 in the service template. This is a strong blocking measure that should be tested in a lab environment first.

REG.EXE ADD HKLM\System\CurrentControlSet\Services\<Servicio> /v UserServiceFlags /t REG_DWORD /d 0 /f

Services Panel: Access, Basic Changes, and Precautions

Windows offers a graphical interface for managing services. You can access it from the Start menu by searching for "Services", from Windows Tools, or from Task Manager , Services tab, using "Open services". The classic method using Win+R and services.msc remains the most direct.

You'll see a list with the name, description, status, startup type, and account. Right-click on a service and you'll have Start, Stop, Pause, Resume, Restart, Update, Properties, and Help. For permanent changes, go to Properties and adjust the "Startup type".

Startup types: Automatic (starts with the system), Automatic (delayed start) (starts after boot, ideal for secondary services), Manual (only on demand), and Disabled (does not start). If you stop a service without changing its type, it will return to its configured state after a reboot.

Before experimenting, create a restore point (or see how to restore deleted or corrupted services ), and use a VM or a secondary machine. Modifying critical services can prevent logins, break the network, or disable security. If you're unsure, it's best not to disable them.

PowerShell and CMD: Fine-grained and fast service control

PowerShell lets you quickly list, filter, and change states. After locating the internal name (Name), you can stop, start, suspend, or restart. Remember to run the console as administrator for system changes.

# Parar
Stop-Service -Name Wecsvc
# Iniciar
Start-Service -Name Wecsvc
# Suspender (si lo admite)
Suspend-Service -Name Wecsvc
# Reiniciar
Restart-Service -Name Wecsvc

To modify the startup type : Set-Service -StartupType. Typical values: Automatic, AutomaticDelayedStart, Manual, Disabled. Use this in conjunction with Stop-Service if you want to stop and block the system simultaneously.

# Deshabilitar para el siguiente arranque
Set-Service -Name Wecsvc -StartupType Disabled
# Parar y forzar
Stop-Service -Name Wecsvc -Force
# Volver a automático y dejarlo ejecutándose
Set-Service -Name Wecsvc -Status Running -StartupType Automatic

With sc.exe, in addition to querying (sc qc), you can adjust the startup: don't forget the space after “start=” . To query templates and instances, use sc qc Name and sc qc Name_LUID.

# Consultar
sc qc BcastDVRUserService
sc qc BcastDVRUserService_18f113
# Configurar inicio
sc.exe config PimIndexMaintenanceSvc start= disabled

Recommended network services for My Cloud and similar devices

If you're using storage like My Cloud OS 5 or My Cloud Home, it's a good idea to keep certain network services running and set to Automatic startup. This facilitates discovery, sharing, and connections. Make sure they're active after any hardening changes.

• Team Navigator
• DHCP Client
• DNS client
• Publishing Feature Discovery Resources
• Network location awareness
• Plug and Play
• SSDP discovery
• Storage server
• employee
• TCP/IP NetBIOS Helper
• UPnP Host Device
• Work station

To adjust them from the Services console: select the service, Properties, change "Startup type" to Automatic and apply; if it is stopped, click Start. Restart the computer to verify that the changes persist.

Repair Microsoft Store and check associated services

For issues with the Microsoft Store, you can re-register the AppX package. The exact path varies depending on the installed version, so first list the folders under C:\Program Files\WindowsApps and locate the one that begins with “Microsoft.WindowsStore…”. Run PowerShell as administrator to avoid permission errors.

# Listar carpetas de WindowsApps
Get-ChildItem -Path "C:\\Program Files\\WindowsApps"
# Registrar Microsoft Store (sustituye por tu ruta exacta)
Add-AppxPackage -DisableDevelopmentMode -Register "C:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_22404.1401.2.0_x64__8wekyb3d8bbwe\\AppxManifest.xml"

Also check the services: “Customer Licensing Service (ClipSVC)” and “AppX Deployment Service (AppXSVC)”. If they are stopped or disabled, the Store may fail.

Install and uninstall Windows services (for developers)

If you're developing a service with the .NET Framework, you can install it using InstallUtil.exe or PowerShell. First, add the service installer to your project in Visual Studio. Note that it doesn't run with F5; it must be installed first.

Using InstallUtil.exe (from the Visual Studio Developer Command Prompt ): navigate to the folder of the compiled executable and run the tool, passing the project's .exe file. InstallUtil is located in %WINDIR%\Microsoft.NET\Framework\<version>. If it's not in your PATH, use the full path.

# Instalar
installutil <tuProyecto>.exe
# Desinstalar
installutil /uninstall <tuProyecto>.exe
# Si queda rastro, borra la entrada del servicio
sc.exe delete "YourServiceName"

Using PowerShell: To create the service, use `New-Service` specifying the name and binary path; to remove it, use `Remove-Service` specifying the name. If the executable no longer exists but the key persists, `sc delete` cleans the Registry. Run with an elevated console to avoid denials.

# Crear
New-Service -Name "YourServiceName" -BinaryPathName <tuProyecto>.exe
# Eliminar
Remove-Service -Name "YourServiceName"
# Limpieza en Registro si hiciera falta
sc.exe delete "YourServiceName"

These services run with elevated permissions and can start in the background. Therefore, Windows requires administrator privileges for their installation and configuration changes. Always verify the security context in the "Login" tab of Properties , and if you need to audit permissions, use accesschk in Windows.

Managing services in Windows 11 isn't about indiscriminately disabling them, but about understanding dependencies, user context, and security objectives. With the Services console for quick adjustments, PowerShell and CMD for automation, and GPOs/Registry for persistent policies, you can fine-tune your system: disable the unnecessary, preserve the critical (notifications, PIM, security), and document every change . This results in a more agile and predictable computer without sacrificing key functionality.