What a service costs when it is doing nothing

A stopped service costs nothing that can be measured, because there is no process to measure: no thread, no handle table, no private bytes, no non-paged pool. A running service that is doing nothing costs at least one thread, whatever handles it left open, and whatever private memory it allocated at start-up, and every one of those four quantities has a name, a definition published by Microsoft and a counter you already have. The reason tweak lists never state the figure is not that it is secret. It is that, per service, it is small.

§1Four documented counters give you the cost of an idle service on your own machine, and nobody selling the tweak publishes them

Costs of a stopped service

0 threads, 0 handles, 0 private bytes

Costs of a running service

≥1 thread · 4 counters to read

Costs to count it yourself

0 · tasklist /svc, in box since XP

The four quantities are all in the Process performance object, and Microsoft’s definitions are short enough to quote in full. Thread Count “shows the number of threads that were active in this process”, and the same page states the floor that matters here: “Every running process has at least one thread.” Handle Count “shows the total number of handles currently open by this process”. Private Bytes “shows the size, in bytes, that this process has allocated that cannot be shared with other processes”. Pool Nonpaged Bytes counts bytes in an area of system memory whose pages “cannot be paged out to the paging file, but instead remain in main memory as long as they are allocated” — the one component of a service’s footprint that a memory cleaner cannot touch and that free RAM is the wrong number takes apart separately.

Getting the figure takes two in-box commands and no download. Microsoft’s own high-CPU guidance, current at 2026-02-12, uses exactly these: open Resource Monitor by entering resmon at Start and sorting the CPU tab by Average CPU, and run tasklist /svc, documented as listing “all the service information for each process without truncation”, to see which services are inside which process. Where a host holds several services, the same guidance gives the separation step: sc config <service name> type= own moves one service into its own process so the counters describe it alone, and it explicitly tells you to reverse the change with type= share afterwards.

What we could not establish. Microsoft publishes no per-service table of idle thread, handle and byte counts, and we cannot supply one: we run no software, so any figure we printed for WSearch or wuauserv would be invented. We looked at the Process counter reference, the services guidance for Windows IoT Enterprise and the Windows Server 2016 service guidelines, and none of them carries a footprint column. So the honest claim on this page is a method, not a number: the cost is countable in four documented counters, it is countable by you in about a minute, and it is the number a product recommending a bulk change should have shown you first.

§2The service control manager reads one registry value, and that value has exactly five documented settings

Costs to change a start type

1 REG_DWORD per service

Documented values

5 · 0x0 through 0x4

Costs of the wrong value on a boot driver

bug check 0x7B — see §6

Everything any services tool has ever sold is one number under HKLM\SYSTEM\CurrentControlSet\Services\<name>\Start. Microsoft documents five values and no more: 0x0 boot, “loaded by the boot loader”; 0x1 system, “loaded by the I/O subsystem”; 0x2 automatic, “loaded automatically by the Service Control Manager during system startup”; 0x3 demand, and 0x4 disabled, “the service is disabled and will not be loaded.” The Win32 side of the same contract states the consequence in an error code rather than in prose: SERVICE_DISABLED is “a service that cannot be started”, and “attempts to start the service result in the error code ERROR_SERVICE_DISABLED.”

The command-line tool exposes six tokens rather than five, and the sixth is worth a sentence because it is where most confusion about this subject starts. sc config <name> start= accepts boot, system, auto, demand, disabled and delayed-auto. There is no Start value of 5. Delayed auto-start is a separate flag, set through ChangeServiceConfig2 with SERVICE_CONFIG_DELAYED_AUTO_START_INFO, and Microsoft is explicit that it “is ignored unless the service is an auto-start service”. A tool that presents six start types as six mutually exclusive registry states is describing its own user interface, not the operating system.

§3Delayed auto-start runs the service’s first thread at the lowest priority, which is the tweak the suites were charging for

Costs at boot, in priority

THREAD_PRIORITY_LOWEST until running

Costs in timing guarantees

0 — “no specific time guarantee”

Costs in load ordering

1 capability lost: no group membership

Windows Vista and Windows Server 2008 shipped the mechanism that most 2009-era “delay your start-up services” tweaks were an approximation of, and the Remarks section of SERVICE_DELAYED_AUTO_START_INFO describes it precisely. The SCM “makes a list of delayed auto-start services during boot and starts them one at a time after the delay has passed, honoring dependencies”. Then the detail that is the whole point: “To minimize the impact on the user, the ServiceMain thread for the service is started with THREAD_PRIORITY_LOWEST”, and it is raised to THREAD_PRIORITY_NORMAL only “after the service has reported that it has entered the SERVICE_RUNNING state.” A low-priority thread issues low-priority I/O, so a delayed service competes with your desktop for the disk on terms the operating system sets.

Row S-03 is TRADE and not a free win, because Microsoft states both costs on the same page. There is “no specific time guarantee as to when the service will be started”, and “a delayed auto-start service cannot be a member of a load ordering group.” There is a third, quieter cost: “if a client calls a delayed auto-start service before it is loaded, the call fails”, so the calling software has to retry or demand-start it. That is the shape of an honest trade — logon reaches the desktop sooner, and three specific guarantees are given up in exchange.

§4Windows has shipped seven documented trigger types since 2009, which is the feature the tweak industry kept selling afterwards

Costs while the trigger is absent

0 — the service is not running

Documented trigger types

7 · since Windows 7 / Server 2008 R2

Costs under memory pressure

delivery not guaranteed

Microsoft’s own summary of service trigger events reads like the sales copy of a services optimiser, which is the joke: a service “can register to be started or stopped when a trigger event occurs”, and this “eliminates the need for services to start when the system starts, or for services to poll or actively wait for an event; a service can start when it is needed, instead of starting automatically whether or not there is work to do.” The SERVICE_TRIGGER structure documents seven trigger types: a device interface class arriving, the first or last IP address on the stack, a domain join or leave, a firewall port opening or closing, a machine or user policy change, a request on a named pipe or an RPC interface, and a custom event from an ETW provider. Six of them shipped in Windows 7 and Windows Server 2008 R2; SERVICE_TRIGGER_TYPE_NETWORK_ENDPOINT is documented as “not supported until Windows 8 and Windows Server 2012”.

You can read any service’s triggers without installing anything, and Microsoft’s own worked example is the one to try first: sc qtriggerinfo w32time returns a service configured to start on DOMAIN JOINED and to stop on NOT DOMAIN JOINED. That is a service which, on a machine that never joins a domain, is configured to cost nothing at all — and it will still appear in a list of “services you should disable”, because the list was written from a service name rather than from a trigger configuration. Row S-04 is SUPERSEDED with the boundary at Win7. The documented limit, stated in one line and worth knowing before you rely on it: “trigger-start and trigger-stop requests are not guaranteed under low memory conditions.”

§5A machine with sixty service hosts is a machine with more than 3.5 GB of RAM, and Microsoft documented the change in 2017

Costs below the documented threshold

17–21 svchost instances

Costs above it

67–74 instances

Costs of the split, in memory

NOT ESTABLISHED — see §5

The most common alarming observation about services is a process list with dozens of identically named entries, and it has a dated, documented, entirely dull explanation. From Windows 10 version 1703, “services that were previously grouped will instead be separated — each will run in its own SvcHost process”, and Microsoft states the condition: “This change is automatic for systems with more than 3.5 GB of RAM running the Client Desktop SKU. On systems with 3.5 GB or less RAM, we’ll continue to group services into a shared SvcHost process.” The same page gives the counts, and they are the answer to the question people actually ask: “instance counts can typically range from approximately 17-21 for grouped services, and 67-74 for separated services.” Sixty-something service hosts is the documented healthy state of a modern desktop, not an infection.

Not everything splits. Microsoft names BFE with Mpssvc, and the RPC Endpoint Mapper with Remote Procedure Call, as groups that stay grouped, and the marker is a per-service registry value: SvcHostSplitDisable under the service’s key, where “the default value of 1 prevents the service from being split.”

What we could not establish, and one inconsistency in the source itself. The value cited everywhere else for this behaviour, SvcHostSplitThresholdInKB with a default of 3670016, appears in no Microsoft source we could find; the value Microsoft documents is the per-service SvcHostSplitDisable, which is why row S-05 is scoped the way it is. And Microsoft’s own reproduction steps on that page do not agree with its own prose: they instruct you to set a virtual machine to “3484 MB or less” to see grouping and “3486 MB or greater” to see separation, which brackets the threshold at about 3,485 MB rather than at 3.5 GB, or 3,584 MB. We report the discrepancy rather than picking the number we prefer. The page’s memory-cost comparison is published only as two screenshots of peak values, so we have no figure for what the split costs in bytes, and neither does anyone quoting it.

§6Dependencies are a graph, a checkbox list is not, and the blast radius of a wrong value is the boot rather than the app

Costs recorded per service

2 values: DependOnService, DependOnGroup

Costs to read the graph

0 · sc qc <name>

Costs of a wrong value on 6 named keys

bug check 0x7B, no desktop

A service records what must start before it. CreateService takes a list of “names of services or load ordering groups that the system must start before this service”, and the SCM writes them as DependOnService and DependOnGroup under the service’s key, alongside Group — and Microsoft flags the trap in the same table: “note that setting this value can override the setting of the DependOnService value.” Group membership is ordered through HKLM\System\CurrentControlSet\Control\ServiceGroupOrder and, for boot and system drivers, tags in HKLM\System\CurrentControlSet\Control\GroupOrderList. Dependency on a group is satisfied loosely: “dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.” The whole structure is a directed graph with cycles detected at creation time — ERROR_CIRCULAR_DEPENDENCY is a documented failure of CreateService — and it is readable for free: sc qc displays DEPENDENCIES along with LOAD_ORDER_GROUP, TAG and ERROR_CONTROL for any service you name.

A list of forty checkboxes cannot represent that. It shows service names as independent rows; the operating system holds them as edges. This is not a complaint about interface design, it is the mechanism by which a bulk change produces a machine that will not boot, and Microsoft documents the endpoint. Its troubleshooting article for bug check 0x7B, INACCESSIBLE_BOOT_DEVICE, tells you to load the offline SYSTEM hive and confirm that ACPI, DISK, VOLMGR, PARTMGR, VOLSNAP and VOLUME each still have a Start value of 0. It then states the failure in as many words: setting a service to disabled where a matching filter-driver entry remains “causes the computer to crash and generate a 0x7b Stop error.”

The second half of the blast radius is the recovery path, and it is also one registry value: ErrorControl. At 0x2 severe, “the error is logged, and the system is restarted with the last-known-good configuration”; at 0x3 critical, “if this fails, startup fails, and the system halts.” So the operating system already has an opinion about which services are load-bearing, expressed per service, in a value that sits two lines from the one the tool is writing — and no product in this category has ever been observed by us to read it.

§7A button that picks services for you cannot publish what it picked, and Microsoft publishes no list for general-purpose Windows either

Costs of the recommendation list

NOT ESTABLISHED — never published

Microsoft lists for Windows client

0 published

Microsoft’s affirmative list, Server 2016

2 services

Those two cards are archived claims from this domain’s own history, and the second is the interesting one, because a recommendation list is a capability boundary turned inside out. The 2013 help topic describes a two-pane interface and a Recommend button that selects services on the user’s behalf; the contents of that selection were never published anywhere we can find, which is question 2 of the Ledger’s standing preamble failing in a single word. Row S-02 is UNVERIFIED and will stay that way permanently: nobody outside the vendor can audit a list that was never printed. The same capture is also, to its credit, where the vendor states the risk itself, in a clause about important services and a crashed computer. The claim and the warning shipped on the same page.

A static list of service names cannot be right on every machine, and the reason is structural rather than a matter of vendor competence. Which services exist depends on the SKU, on installed roles and optional components, and on drivers, since every driver has a key in the same tree. Per-user services are created at sign-in from registry templates and deleted at sign-out, so they are not even a fixed set within one installation. And trigger-start means the set of services running changes minute to minute as devices arrive, addresses appear and policy applies. A list frozen in a 2012 build is describing a machine that no longer exists.

The strongest evidence for this is what Microsoft itself declines to publish. There is no service-disabling list for general-purpose Windows client. There is one for Windows Server 2016 with Desktop Experience, scoped in its own words to that product “unless you’re using it as a desktop replacement for end-users”, and its affirmative recommendation runs to two services: Xbox Live Auth Manager and Xbox Live Game Save. Under a heading called Disabling non-default services it says the sentence that ought to end this argument: “We don’t recommend applying policies that disable services that aren’t by default by Microsoft.” There is a second list, for Windows IoT Enterprise, and its framing is fixed-function devices rather than desktops. We counted its system-services table on 2026-08-06: 232 rows, of which 88 are marked “Don’t disable”, 119 “OK to disable”, 14 “No guidance”, 7 already disabled by default and 4 that “should never be enabled on a well-managed enterprise system”. That is the shape of a real answer: per service, per product, with a category for “we have not evaluated this”. Row S-01 is DEPENDS because the condition is which service, and no product in this category has ever been willing to say.

§8Four services people are told to disable, with the documented failure and how long it stays invisible

Costs to disable, in effort

1 value per service

Costs to notice, shortest

same session

Costs to notice, longest

months — 1 update cycle at a time

The advice survives because the consequences are separated from the change by enough time that nobody connects them. Below, the failure text is Microsoft’s, taken from the services guidance for Windows IoT Enterprise, dated 2026-06-24. The latency column is our inference from what each service does, not a measurement, and we say so rather than dressing it as data.

Two of those four deserve an extra line. The wuauserv entry has a second cost that is invisible even to a careful user: the API clause means installers and management tools that call the Windows Update Agent fail, which produces a support call nobody traces back to a checkbox ticked six months earlier. And W32Time, which is marked “Don’t disable” in the same table and appears on every disable list ever written, has a failure mode with a documented threshold rather than a vague one: on a domain-joined machine, Kerberos tolerates a client-to-controller clock difference set by the Maximum tolerance for computer clock synchronization policy, whose default value Microsoft gives as 5 minutes. Beyond that, authentication stops. We could not establish how long an unsynchronised clock takes to drift five minutes, because that depends on the hardware, and we will not guess.

§9The honest wins exist, and both of them are cases where Microsoft names the service and states the cost in the same paragraph

Costs of the indexer, by item count

>400,000 items → documented problems

Costs of stopping it

content results gone from Start and Explorer

Costs of stopping the spooler on a DC

print pruning stops; queues go stale

WSearch is a real trade with numbers on both sides, which is why row S-06 is TRADE and not a dismissal. Microsoft’s figures: “on a typical user’s computer, the Indexer indexes fewer than 30,000 items”; a power user might reach 300,000; “if the Indexer indexes more than 400,000 items, you may begin to see performance issues”; the hard ceiling is about one million, beyond which it “may fail or cause resource problems”. The index database is “generally 10 percent of the size of the content that is being indexed”. So there is a condition under which stopping it is a measurable saving, and it is a condition you can read off your own machine in the Searching Windows settings page rather than take from a list. The same article records what the service does when left alone: it stops when disk or CPU use is high, pauses on battery power, and resumes fifteen minutes after a manual pause. An idle indexer is idle by design, and the first tuning step Microsoft offers is excluding folders rather than disabling the service.

The second case is the cleanest example in the record of Microsoft telling you to disable a service, and it is worth reading for the form as much as the content. Defender for Identity’s identity-infrastructure guidance states that “domain controllers and Active Directory admin systems need to have the Print spooler service disabled”, gives the reason — any authenticated user can reach a domain controller’s spooler and cause it to expose the machine account credential — and then, in the same note, states what it costs: the domain controller role adds a spooler thread that performs print pruning, so “the security recommendation to disable the Print spooler service is a trade-off between security and the ability to perform print pruning.” Named service, named threat, named cost, named scope. That scope is servers and not your laptop, and we state it plainly rather than borrowing the authority of a server document for a desktop argument.

What is not a win is worth saying with equal force. The memory a disabled service gives back is the private bytes that one process was holding, which is the number §1 tells you to read before you decide — and on the machines where these lists get applied, that number is usually a few megabytes against a working set of several gigabytes. Row S-07 is DEPENDS for SysMain for the same reason and with the condition named: Windows already decides that one per drive, by benchmarking, and Microsoft’s current guidance for the service reads “Don’t disable”.

§10Putting a service configuration back takes one command, and a defensible tool would have exported it before touching anything

Costs to restore one service

1 sc config command, elevated

Costs to restore a machine that will not boot

0 downloads · WinRE + 1 hive load

Costs of a tool that batches silently

NOT ESTABLISHED — see §7

Read the value before you change it, in one command: sc qc <name> prints the service’s type, error control, binary path, load-order group, tag, display name, dependencies and start account. Put it back with sc config <name> start= auto, or demand, or delayed-auto — and note Microsoft’s own syntax warning, which catches people every time: “a space is required between an option and its value… if the space is omitted, the operation fails.” Both commands are in the box and neither needs a product.

If the machine no longer starts, the supported route is offline and documented end to end in Microsoft’s 0x7B article, updated 2026-02-12. Boot the installation media into the recovery environment, open the command prompt, load C:\Windows\System32\config\SYSTEM as a hive in regedit, read Select\Default to learn which ControlSet is the live one, and fix Start under that control set’s Services key. That article’s own checklist — ACPI, DISK, VOLMGR, PARTMGR, VOLSNAP, VOLUME, each at Start = 0 — is the shortest checklist in this article and the most valuable, because it is what stands between a bad batch change and a reinstall.

So what would a defensible services tool look like in 2026? We think it is four properties and no features. It enumerates and names the surface for every row, so the reader can look the service up. It publishes a capability boundary: which start types, which trigger configurations, which per-user templates it reads and writes, and which it does not. It exports the previous value in a form you can read and re-apply six months later — the sc qc output would do. And it refuses to batch, because a graph cannot be edited safely through a list. Nothing in that description is hard to build, and nothing in it converts, which is the actual reason it does not exist. The modern answer pays us nothing and is already installed: services.msc, sc qc, tasklist /svc, and Sysinternals Autoruns, whose -a s switch is documented as covering “autostart services and non-disabled drivers” — one of the sixteen categories taken apart in sixteen places Windows can start a program.

§11Standing: what this page establishes and what it does not

Costs in primary sources

20 cited, all accessed 2026-08-06

Costs in unresolved rows

1 UNVERIFIED of 8 touched

Costs we measured ourselves

0 — we run no software

§12Sources & method: every claim above, with the page it came from

Costs in fetches

20 sources, fetched 2026-08-06

Costs in vendor prose republished

0 sentences · 2 quotes, ≤11 words each

Costs in screenshots

0, permanently

Method, plainly: every Microsoft page below was fetched and read on 2026-08-06, and the two archived vendor pages were fetched from the Internet Archive on the same date at the capture URLs printed in the claim cards. The counts in §7 were made by us from the live table on that date and are re-checkable by counting the same column. Source 1 carries ai-usage: ai-assisted in its own page metadata, so every value taken from it was cross-checked against source 2, which is hand-written API reference; the two agree. Nothing here was measured by us: this page contains no timings, no footprint figures of our own and no first-hand account, because we do not run the software this category sells and we have never run Windows Winset.

1. HKLM\SYSTEM\CurrentControlSet\Services registry tree, learn.microsoft.com, ms.date 2024-09-18 — Start, Type, ErrorControl. Accessed 2026-08-06
2. CreateServiceW function (winsvc.h) — start types, error control, lpDependencies, lpLoadOrderGroup, and the value table including DependOnService. Accessed 2026-08-06
3. SERVICE_DELAYED_AUTO_START_INFO structure — THREAD_PRIORITY_LOWEST, the timing guarantee, load ordering groups. Accessed 2026-08-06
4. Service trigger events — including the sc qtriggerinfo w32time example and the low-memory limit. Accessed 2026-08-06
5. SERVICE_TRIGGER structure (winsvc.h) — the seven trigger types and their version boundaries. Accessed 2026-08-06
6. Service host grouping in Windows 10, ms.date 2017-07-20 — the 3.5 GB condition, the instance counts, SvcHostSplitDisable, the grouping exceptions. Accessed 2026-08-06
7. Guidance on configuring system services (Windows IoT Enterprise), ms.date 2026-06-24 — the per-service recommendations and consequence text used in §8. Accessed 2026-08-06
8. Security guidelines for system services in Windows Server 2016, ms.date 2024-08-22 — the scoping statement, the two-service affirmative list, and the non-default-services paragraph. Accessed 2026-08-06
9. Troubleshoot Windows Search performance (KB 4558579), ms.date 2026-02-12 — item thresholds, index size, throttling, and the “Optimize your PC” sentence. Accessed 2026-08-06
10. sc.exe config, ms.date 2018-06-05 — the six start= tokens and the required space. Accessed 2026-08-06
11. Sc qc (archived, Windows Server 2012 R2), ms.date 2016-08-31 — the fields the qc operation displays. Accessed 2026-08-06
12. tasklist, ms.date 2017-10-16 — the /svc parameter. Accessed 2026-08-06
13. Process Object: Core Services (archived, Windows Server 2003) — Thread Count, Handle Count, Private Bytes, Pool Nonpaged Bytes. Carries Microsoft’s archived-content banner. Accessed 2026-08-06
14. Guidance for troubleshooting high CPU usage, ms.date 2026-02-12 — resmon, tasklist /svc, and the sc config type= own separation step. Accessed 2026-08-06
15. Stop error 7B or Inaccessible_Boot_Device troubleshooting, ms.date 2026-02-12 — the offline hive procedure and the six boot-critical service keys. Accessed 2026-08-06
16. Maximum tolerance for computer clock synchronization (archived) — the 5-minute Kerberos default. Accessed 2026-08-06
17. Identity infrastructure security posture assessments (Microsoft Defender for Identity), ms.date 2025-09-10 — the print spooler recommendation and the print-pruning trade-off. The older security-assessment-print-spooler path redirects here. Accessed 2026-08-06
18. Autoruns (Sysinternals), published 2026-06-17 — the autorunsc -a switch table. Accessed 2026-08-06
19. Archived Windows Winset capability index, tlwinset.com/help.htm, Internet Archive capture 2012-08-24. Accessed 2026-08-06
20. Archived Windows Winset help topic on services, tlwinset.com/wineb/wh5.htm, Internet Archive capture 2013-09-24. Accessed 2026-08-06

Previous · What a “registry error” actually is — the registry is a few files and a fast key-value store, so what exactly is a cleaner counting when it reports 2,317 errors?

Next · What happens before your desktop appears — prefetch, ReadyBoot and SysMain are a measurement system rather than clutter, and emptying the Prefetch folder makes the next several boots slower.