Tweaking Optimizing Windows.pdf - GEGeek

Recommendation: This service will function properly when called upon with a status of manual, so no change need be
made. If you notice the nddeagnt.exe process running frequently, you're better off not disabling this service (not that you'd gain
anything in particular by disabling it in the first place).
Network DDE DSDM
Process Name:
Netdde.exe
Default Setting:
Manual (Workstation), Manual (Server)
Description:
This service manages the shared DDE conversations (from shares like: \\computername\ndde$). The
Network DDE service above requires this "father" service to be started. For what's it worth, the full-name is Network Dynamic Data
Exchange Share Database Manager.
Recommendation: Take the same approach for this service as you would for its complement, just above.
NT LM Security Support Provider
Process Name:
Services.exe
Default Setting: Manual (Workstation), Manual (Server)
Description:
Extends NT security to Remote Procedure Call (RPC) progs using various transports other than named
pipes. This activity is quite common, as most apps going the RPC route don't use named pipes.
Recommendation: As I implied in the description, this is activity is common, so don't be messin' here. The functionality
offered by the service is viable with a setting of manual, so changing it to automatic is unnecessary.
Plug and Play
Process Name:
Services.exe
Default Setting: Automatic (Workstation), Automatic (Server)
Description:
A service that fudges some functionality of Plug and Play, standard in Windows 9x. For those of you
having used unimodem modems in NT4, you should be quite familiar with this service (as it's needed to detect and use such
modems). Other than that, we all know what PnP is.
Recommendation: Unless you specifically require this service's abilities to support a certain piece of hardware, I suggest
setting the status to manual and saving yourself some memory.
Protected Storage
Process Name:
Pstores.exe
Default Setting: Automatic (IE4, or higher)
Description:
A service coming from the IE development team, starting with IE4. NT uses PS to encrypt and store
secure info like SSL certificates, passwords for apps (like Outlook, Outlook Express, etc.), info stored by Profile Assistant, info
maintained by MS Wallet, and digitally signed S/MIME keys.
Recommendation: After installing IE4 or higher, the pstores.exe process will start automatically on system boot. Many
folks originally changed the service's status to manual, without suffering any obvious ill-affects. I did the same until IE5, as I now
use the MS Wallet. Additionally, since the IE Dev folks just seem to keep piling more and more dependency on this, we might as
well get used to having it around right now. I figure those of us not using Netscape should just suck it up, and leave this guy
running (even though the process seems to start itself, even when set on manual).
Remote Procedure Call (RPC) Locator
Process Name:
Locator.exe
Default Setting: Manual (Workstation), Manual (Server)
Description:
Maintains the RPC name server database, and requires the RPC service (just below) to be started. In a
two-tier distributed model, the server half registers its status with the maintained database, while the clients query said database to
locate available server applications.
Recommendation: Because the service starts on demand, there's no need to alter the status setting of this service.
Disabling the RPC Locator service would be highly detrimental to your machine, especially if that machine took part in a NT
networked environment.
Remote Procedure Call (RPC) Service
Process Name:
Rpcss.exe
Default Setting: Automatic (Workstation), Automatic (Server)
Description:
As is evident by the process name alone, this service is a subsystem. This RPC subsystem is crucial to
the operations of any RPC activities taking place on a system (most DCOM stuff, Server and User Manager, etc.). Rpcss.exe is also
known as dcomss.exe (Distributed Common Object Model).
Recommendation: Changing its status from automatic (to either manual or disabled) would be highly problematic for the
continued health of the machine, especially if it's networked. Don't mess! Leave on automatic.
Schedule
Process Name:
atsvc.exe
Default Setting: Manual (Workstation), Manual (Server)
Description:
As the process name eludes to, this service is also referred to as the AT service. This service is required
for the use of the AT (or SOON) command, which allows the scheduling of commands or progs to be run on a specific computer, at a
specified time & date. NT admins are no strangers to this tool, and a domain administrator account is often used in the Run Service
As option.
Recommendation: Unless you plan to be sending AT jobs to the machine in question, there's no need to have this service
started. Therefore, go ahead and leave the status of this service alone.
Server
Process Name:
Services.exe
Default Setting: Automatic (Workstation), Automatic (Server)
Description:
Provides support for file, print, and named pipe sharing via the SMB services. As a whole, this can be
thought of as a subsystem for NT sharing (directories and printers).
Recommendation: Believe it or not, MS actually recommends folks running IIS to disable this service! I suggest that
the rest to choose between automatic and manual, with the key distinction being whether or not you plan to do sharing on the
machine. If not, go with manual ... if so, just say automatic.