Per-user services in Windows

When a user signs in to Windows, the OS creates per-user services. When the user signs out, these services are stopped and deleted. They run in the security context of the user account instead of a built-in security principal. This behavior provides better resource management than the previous approach of running these services associated with a preconfigured account or as tasks.

Windows creates these per-user services based on templates defined in the registry. If you need to manage or control behaviors of these services, you can adjust the template. For example, you can set a template service's startup type to Disabled. In this example, Windows creates the per-user service in a stopped and disabled state.

Use the information in this article to understand per-user services, configure user service templates, and manage per-user services through group policy and security templates.

List of per-user services

The following table lists per-user services in the current version of Windows. Other versions of Windows 10/11 might not have the same services available.

Before you reconfigure any of these services, review this information to understand the implications. For example, if you disable the per-user service, there might be dependent apps that don't work correctly.

View per-user services

You can't view the user service templates outside of the Windows Registry, but you can see the user-specific per-user services. Windows displays these services with the following format: <service name>_LUID where <service name> is the display name of the user service and LUID is a locally unique identifier for the user context.

For example, you might see the following per-user service names:

• Contact Data_443f50
• Sync Host_443f50
• User Data Access_443f50
• User Data Storage_443f50

View per-user services in the Windows Services console

When you sign in to Windows, run services.msc to open the Services console. When you view the local machine, you can see these services for your user account.

View per-user services using Windows PowerShell

The following PowerShell script is an example of how to query for per-user services. It queries for service type values that include the 64 bit value.

# Define the bit value for per-user services in the ServiceType property of a service object
$flag = 64

# Define an empty array to store the resulting services that match the criteria
$serviceList = @()

# Get all services on the computer and store them in the variable
$services = Get-Service

# Loop through each service in the array of services.
foreach ( $service in $services ) {
  # For each specific service, check if the service type property includes the 64 bit using the bitwise AND operator (-band).
  # If the result equals the flag value, then the service is a per-user service.
  if ( ( $service.ServiceType -band $flag ) -eq $flag ) {
    # When a per-user service is found, then add that service object to the results array.
    $serviceList += $service
  }
}

# Display the results array, sorted by display name, in a table format with the specified properties.
$serviceList | Sort-Object DisplayName | Format-Table DisplayName, Name, StartType, ServiceType

View per-user services from the command line

Run cmd.exe to open a Windows command prompt. Use the sc qc command to query these services. The Type value indicates whether the service is a user-service template or user-service instance.

The following example queries for the template and user-specific instance of the Game DVR and Broadcast User Service (BcastDVRUserService) service:

sc qc BcastDVRUserService
sc qc BcastDVRUserService_18f113

How to disable per-user services

The templates for user services aren't displayed in the Services console (services.msc). To disable a per-user service, you need to directly edit the registry, either with group policy or a scripted solution. The templates are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

You can't manage all of the per-user service templates using normal group policy management methods. Because the per-user services aren't displayed in the Services management console, they're also not displayed in the group policy services policy editor.

Additionally, there are four user services that you can't manage with a security template:

• PimIndexMaintenanceSvc
• UnistoreSvc
• UserDataSvc
• WpnUserService

With these restrictions, you can use the following methods to manage per-user service templates:

• A combination of a security template and a script, or group policy preferences registry policy.
• Group policy preferences for all of the services.
• A script for all of the services.

Manage template services using a security template

You can manage the CDPUserSvc and OneSyncSvc per-user services with a security template.

For example:

[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Service General Setting]
"CDPUserSVC".4,""

Use a script to manage per-user services

You can create a script to change the startup type for the per-user services. Then use group policy or another management solution such as Microsoft Configuration Manager to deploy the script to targeted devices.

Example 1: Use the Set-Service PowerShell cmdlet

The following sample script uses the Set-Service PowerShell cmdlet to configure the PimIndexMaintenanceSvc service start type to disabled:

Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled

Example 2: Use the sc.exe config command line

The following sample script uses sc.exe config to configure the PimIndexMaintenanceSvc service start type to disabled:

sc.exe configure PimIndexMaintenanceSvc start= disabled

Manage template services using group policy preferences

If you can't disable a per-user service with the security template, use group policy preferences.

1. Open the Group Policy Management Console (gpmc.msc).

2. Create a new group policy object (GPO) or use an existing GPO.

3. Edit the GPO to launch the group policy object editor.

4. Depending on how you want to target the group policy, under Computer configuration or User configuration browse to Preferences, Windows Settings, and select Registry.

5. Go to the Action menu, select New, and select Registry Item.

   

6. For the Hive select HKEY_LOCAL_MACHINE.

   

7. Select the ellipses (...) next to Key Path. Browse to System\CurrentControlSet\Services and then select the user service template. For example, PimIndexMaintenanceSvc. In the list of values, highlight Start and select Select.

   

8. In the Start Properties window, Change Value data from 00000003 to 00000004 and select OK. Note setting the Value data to 4 = Disabled.

   

   Note

   The service start value 4 is Disabled.

9. To add the other services that can't be managed with group policy templates, edit the policy and repeat the previous steps.

Managing user service templates with the Windows Registry

If you can't use group policy preferences to manage the per-user services, you can edit the Windows Registry. To disable a user service template, change the startup type for each service to 4, which is Disabled.

Example 1: Use the reg.exe command line command to edit the registry

1. As an administrator, run cmd.exe to open a Windows command prompt.

2. The following example includes multiple commands that disable the specified Windows services by changing their Start value in the Windows Registry to 4:

   REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f
   REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f
   REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f
   REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f
   REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f
   REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f
   

Example 2: Use the Registry Editor user interface to edit the registry

1. As an administrator, run regedit.exe to open the Registry Editor.

2. Browse to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services and then select the user service template. For example, CDPSvc.

3. In the list of values, open the Start value.

4. Change the Value data to 4.

   

Example 3: Prevent the creation of per-user services

You can prevent Windows from creating a per-user service when a user signs on. In the same service template node of the registry, set UserServiceFlags to 0.

Next steps

For more information about disabling system services for Windows Server, see Guidance on disabling system services on Windows Server with Desktop Experience.