Hardening Requirement: Disable Unnecessary Services on Domain Controllers

Target Scope

• Applicable Systems: Domain Controllers (DCs) running Windows Server.
• Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022.

Implementation Details

• Priority: Medium
• GPO Path / Registry Location:
  • Computer Configuration\Preferences\Windows Settings\Registry
  • HKLM\SYSTEM\CurrentControlSet\Services\\Start

Rationale

Domain Controllers are the core authority within an Active Directory forest (Tier 0). Minimizing the running services on these critical systems reduces the overall attack surface and limits potential targets for local privilege escalation, remote exploit execution, or credential extraction.

Disabling non-essential services aligns with the principle of least functionality. In accordance with the Microsoft security guidelines for system services, services can be categorized by whether they should be disabled, are OK to disable if unused, or are already disabled by default.

Technical Services Baselines

The following tables list default services in Windows Server and their hardening recommendations.

Services That Should Be Disabled

These services present an unnecessary security risk and should be disabled on all Domain Controllers.

Additional Services That Can Be Disabled (OK to Disable)

These services are installed by default but are not required for Domain Controller functionality. They should be disabled to minimize the attack surface.

Note: The Print Spooler (Spooler) service is also listed as OK to disable on non-print servers, but it is managed separately as a High-priority control for Domain Controllers.

Default Services Already Disabled in Windows Server 2016+

These services are disabled by default. Administrators must ensure they are not manually re-enabled without verification.

Critical Services That Must Not Be Disabled (Do Not Disable)

The following services are essential for system stability, network roles, administration, or virtualization integration, and must not be disabled.

[!WARNING] Disabling any of the services listed below will severely degrade or completely break core system functionality, remote management access, or hypervisor integrations. Under no circumstances should these services be disabled.

Legacy Impact & Compatibility

• No Functional Impact: Disabling the specified services has no operational impact on Active Directory Domain Services, replication, group policy processing, client authentication, or administrative management tools.
• Smart Cards: If your domain relies on Smart Card authentication, the Smart Card Device Enumeration Service (ScDeviceEnum) and Smart Card (SCardSvr) services must remain enabled.
• Desktop Experience Feature Scope: The specified services are primarily present on Windows Server installations with Desktop Experience. On Windows Server Core installations, most of these services are not installed by default, and attempts to stop or disable them will simply be skipped.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

Because many of these services are not managed through standard GPO Administrative Templates (ADMX), they should be disabled by configuring Group Policy Preferences (GPP) for the registry:

1. Open the Group Policy Management Console (gpmc.msc) on a domain management host.
2. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers).
3. Navigate to: Computer Configuration\Preferences\Windows Settings\Registry
4. For each service listed below, create a new Registry Preference (Right-click Registry -> New -> Registry Item):
   • Action: Update
   • Hive: HKEY_LOCAL_MACHINE
   • Key Path: SYSTEM\CurrentControlSet\Services\<ServiceName> (e.g., SYSTEM\CurrentControlSet\Services\XblAuthManager)
   • Value name: Start
   • Value type: REG_DWORD
   • Value data: 4

Apply this registry change for the service names listed in the tables above.

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Run the following script to configure the registry settings and stop the services locally:

Download Script: Configure-DisableUnnecessaryServices.ps1

# Configure-DisableUnnecessaryServices.ps1
# Description: Stops and disables unnecessary services on Domain Controllers.

Write-Host "Applying hardening requirement: Disable Unnecessary Services on Domain Controllers..." -ForegroundColor Cyan

$services = @(
    "XblAuthManager",
    "XblGameSave",
    "AxInstSV",
    "bthserv",
    "CDPUserSvc",
    "PimIndexMaintenanceSvc",
    "dmwappushservice",
    "MapsBroker",
    "lfsvc",
    "SharedAccess",
    "lltdsvc",
    "wlidsvc",
    "NgcSvc",
    "NgcCtnrSvc",
    "NcbService",
    "PhoneSvc",
    "PrintNotify",
    "PcaSvc",
    "QWAVE",
    "RmSvc",
    "SensorDataService",
    "SensrSvc",
    "SensorService",
    "ShellHWDetection",
    "ScDeviceEnum",
    "SSDPSRV",
    "WiaRpc",
    "OneSyncSvc",
    "upnphost",
    "UserDataSvc",
    "UnistoreSvc",
    "WalletService",
    "Audiosrv",
    "AudioEndpointBuilder",
    "FrameServer",
    "stisvc",
    "wisvc",
    "icssvc",
    "WpnService",
    "WpnUserService"
)

foreach ($serviceName in $services) {
    Write-Host "Processing service $($serviceName)..." -ForegroundColor Gray

    # Stop the service if it is running
    $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
    if ($service) {
        if ($service.Status -eq "Running") {
            Stop-Service -Name $serviceName -Force -ErrorAction SilentlyContinue
            Write-Host "  Service $($serviceName) stopped." -ForegroundColor Gray
        }
    }

    # Disable the service startup in registry
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"
    if (Test-Path $regPath) {
        Set-ItemProperty -Path $regPath -Name "Start" -Value 4 -Type DWord
        Write-Host "  Service $($serviceName) startup disabled in registry." -ForegroundColor Green
    } else {
        Write-Host "  Service $($serviceName) is not installed." -ForegroundColor Gray
    }
}

Write-Host "Remediation completed successfully." -ForegroundColor Cyan

To verify that the services have been disabled:

Download Script: Get-UnnecessaryServicesStatus.ps1

# Get-UnnecessaryServicesStatus.ps1
# Description: Audits the registry startup state of unnecessary system services.

Write-Host "--- Auditing Unnecessary Services on Domain Controllers ---" -ForegroundColor Cyan

$services = @(
    "XblAuthManager",
    "XblGameSave",
    "AxInstSV",
    "bthserv",
    "CDPUserSvc",
    "PimIndexMaintenanceSvc",
    "dmwappushservice",
    "MapsBroker",
    "lfsvc",
    "SharedAccess",
    "lltdsvc",
    "wlidsvc",
    "NgcSvc",
    "NgcCtnrSvc",
    "NcbService",
    "PhoneSvc",
    "PrintNotify",
    "PcaSvc",
    "QWAVE",
    "RmSvc",
    "SensorDataService",
    "SensrSvc",
    "SensorService",
    "ShellHWDetection",
    "ScDeviceEnum",
    "SSDPSRV",
    "WiaRpc",
    "OneSyncSvc",
    "upnphost",
    "UserDataSvc",
    "UnistoreSvc",
    "WalletService",
    "Audiosrv",
    "AudioEndpointBuilder",
    "FrameServer",
    "stisvc",
    "wisvc",
    "icssvc",
    "WpnService",
    "WpnUserService"
)

$vulnerableCount = 0

foreach ($serviceName in $services) {
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$serviceName"
    if (Test-Path $regPath) {
        $startVal = Get-ItemProperty -Path $regPath -Name "Start" -ErrorAction SilentlyContinue
        if ($startVal) {
            $start = $startVal.Start
            if ($start -eq 4) {
                Write-Host "[+] Service $($serviceName) is secure (Disabled)." -ForegroundColor Green
            } else {
                Write-Host "[!] VULNERABLE: Service $($serviceName) startup type is not Disabled (Start value is $($start))." -ForegroundColor Red
                $vulnerableCount = $vulnerableCount + 1
            }
        } else {
            Write-Host "[!] VULNERABLE: Service $($serviceName) exists but Start registry value is missing." -ForegroundColor Red
            $vulnerableCount = $vulnerableCount + 1
        }
    } else {
        Write-Host "[+] Service $($serviceName) is not installed (Secure)." -ForegroundColor Green
    }
}

if ($vulnerableCount -gt 0) {
    Write-Host "Audit failed: $($vulnerableCount) service(s) are not disabled." -ForegroundColor Red
} else {
    Write-Host "Audit passed: All non-essential services are disabled or not installed." -ForegroundColor Green
}

Sources & Compliance References

• Microsoft Windows Server Security Guidance: Security guidelines for disabling system services in Windows Server
• ANSSI AD Hardening Guide: Recommendation R4 (Minimization of service execution and software installation)
• CIS Microsoft Windows Server Benchmark: Section 2.2 (User Rights Assignment) and general service minimization baselines