Performance Less responsive to the user Consumes resources from foreground applications Impacts boot, shutdown, and logoff Reliability Memory leaks System crashes, hangs Dependent application crashes Security An activity can require system privileges A successful attack can compromise the entire system Power Consumption Extra disk, CPU utilization Decrease in battery life Prevents idle efficiencies

ResourceQuantity File I/O47,286 Copy-on-write (COW) pages4,656 (~18MB) Memory pages (Total)15,967 (~60MB) Registry operations38,508 Threads367

Windows Service Continuous activity from boot to shutdown SCM (Service Control Manager) programming model Can specify dependency Continuous activity from boot to shutdown SCM (Service Control Manager) programming model Can specify dependency Scheduled Task Short duration action Idle activity Take action on user logon Standalone executable or out-of-process COM server Generally execute during a user session Short duration action Idle activity Take action on user logon Standalone executable or out-of-process COM server Generally execute during a user session

Service NameService PurposeTrigger Type AELookupSvc Processes application compatibility cache requests for applications as they are launched Custom ETW BDESVC Provides BitLocker client services for user interface and auto-unlocking of data volumes Custom ETW BTHSERV Supports discovery and association of remote Bluetooth devices Device SensorsMTPMonitor Monitors MTP (Media Transfer Protocol) sensors, such as a cell phone with a GPS receiver, to communicate sensor data to programs Device TabletInputService Enables pen and ink functionality Device WinDefend Protects against spyware and potentially unwanted software Group Policy Example of Trigger-Start Services

SERVICE_REQUIRED_PRIVILEGES_INFO srpInfo; WCHAR mszPrivilegeBuffer[25] = {0}; hSCManager=OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT); hFooService=OpenService(hSCManager, wszSERVICENAME, SERVICE_CHANGE_CONFIG); ( VOID ) StringCbCopy ( mszPrivilegeBuffer, sizeof(mszPrivilegeBuffer), L”SeChangeNotifyPrivilege”); srpInfo.pmszRequiredPrivileges = mszPrivilegeBuffer; ChangeServiceConfig2 ( *phService, SERVICE_CONFIG_REQUIRED_PRIVILEGES_INF O, &srpInfo) )

Detects Idle Condition Launches Task