System Services

Updated: March 28, 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

System Services

This security setting allows you to define the startup mode (manual, automatic, or disabled) and access permissions for all services (Start, Stop, or Pause). You can also edit other security properties of the service, such as which user or group accounts have permission to read, write, delete, or execute inheritance settings or auditing and ownership permission by clicking Edit Security.


GPO_name\Computer Configuration\Windows Settings\Security Settings\System Services\

Default Values


Server Type or GPO Default Value

Default Domain Policy

Not defined for any service

Default Domain Controller Policy

Not defined for any service

Stand-Alone Server Default Settings

Not defined for any service

DC Effective Default Settings

Not defined for any service

Member Server Effective Default Settings

Not defined for any service


System services are processes that normally run in the background. An administrator uses the Services snap-in to manage system services directly. To manage system services through security policy, administrators can use the System Services security setting.

This security setting does not appear in the local Group Policy object.

If you choose to set system service startup to Automatic, perform adequate testing to verify that the services can start without user intervention.

For performance optimization, set unnecessary or unused services to Manual.

To find descriptions of each individual service (including what happens when you stop it from running), see the “System Services chapter of Threats and Countermeasures: Security Settings” in Windows Server 2003 and Windows XP, which can be downloaded from the Microsoft Web site.

Community Additions