Learn about per-user services, how to change the template service startup type, and manage per-user services through group policy and security templates.

Per-user services in Windows

When a user signs in to Windows, the OS creates per-user services. When the user signs out, these services are stopped and deleted. They run in the security context of the user account instead of a built-in security principal. This behavior provides better resource management than the previous approach of running these services associated with a preconfigured account or as tasks.

Windows creates these per-user services based on templates defined in the registry. If you need to manage or control behaviors of these services, you can adjust the template. For example, you can set a template service's startup type to Disabled. In this example, Windows creates the per-user service in a stopped and disabled state.

Use the information in this article to understand per-user services, configure user service templates, and manage per-user services through group policy and security templates.

List of per-user services

The following table lists per-user services in the current version of Windows. Other versions of Windows 10/11 might not have the same services available.

Before you reconfigure any of these services, review this information to understand the implications. For example, if you disable the per-user service, there might be dependent apps that don't work correctly.

View per-user services

You can't view the user service templates outside of the Windows Registry, but you can see the user-specific per-user services. Windows displays these services with the following format: <service name>_LUID where <service name> is the display name of the user service and LUID is a locally unique identifier for the user context.

For example, you might see the following per-user service names:

Contact Data_443f50
Sync Host_443f50
User Data Access_443f50
User Data Storage_443f50

Note: The display name and the service name for all per-user services include the same LUID suffix.

How to disable per-user services

The templates for user services aren't displayed in the Services console (services.msc). To disable a per-user service, you need to directly edit the registry, either with group policy or a scripted solution. The templates are located in the registry at

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Note: When you disable a per-user service, Windows still creates it when the user signs in, but in a stopped and disabled state. When the user signs out, Windows removes the per-user service.

You can't manage all of the per-user service templates using normal group policy management methods. Because the per-user services aren't displayed in the Services management console, they're also not displayed in the group policy services policy editor.

Additionally, there are four user services that you can't manage with a security template:

• PimIndexMaintenanceSvc
• UnistoreSvc
• UserDataSvc
• WpnUserService

With these restrictions, you can use the following methods to manage per-user service templates:

• A combination of a security template and a script, or group policy preferences registry policy.
• Group policy preferences for all of the services.
• A script for all of the services.

Use a script to manage per-user services

You can create a script to change the startup type for the per-user services. Then use group policy or another management solution such as Microsoft Configuration Manager to deploy the script to targeted devices.

Example 1: Use the Set-Service PowerShell cmdlet

The following sample script uses the Set-Service PowerShell cmdlet to configure the PimIndexMaintenanceSvc service start type to disabled:
PowerShell

Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled

Example 2: Use the sc.exe config command line

The following sample script uses sc.exe config to configure the PimIndexMaintenanceSvc service start type to disabled:
Windows Command Prompt

sc.exe configure PimIndexMaintenanceSvc start= disabled

Note: The space after = is intentional.

Managing user service templates with the Windows Registry

If you can't use group policy preferences to manage the per-user services, you can edit the Windows Registry. To disable a user service template, change the startup type for each service to 4, which is Disabled.

Caution: Don't directly edit the registry unless there's no other alternative. The Registry Editor or Windows don't validate these manual modifications to the registry. Incorrect values can be stored, which can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use group policy or other supported Windows tools to accomplish these tasks. If you must edit the registry, use extreme caution.

Example 1: Use the reg.exe command line command to edit the registry

1 As an administrator, run cmd.exe to open a Windows command prompt.
2 The following example includes multiple commands that disable the specified Windows services by changing their Start value in the Windows Registry to 4:

Windows Command Prompt 

REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f
REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f

Example 2: Use the Registry Editor user interface to edit the registry

1 As an administrator, run regedit.exe to open the Registry Editor.
2 Browse to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services and then select the user service template. For example, CDPSvc.
3 In the list of values, open the Start value.
4 Change the Value data to 4.

Example 3: Prevent the creation of per-user services

You can prevent Windows from creating a per-user service when a user signs on.
In the same service template node of the registry, set UserServiceFlags to 0.