unsure what these services are?

Snowe 20 Reputation points
2026-09-04T15:33:30.05+00:00

User's image

Screenshot 2026-09-04 162927

Windows for home | Windows 10 | Security and privacy
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Ferdinand Nanalig 32,825 Reputation points Independent Advisor
    2026-09-04T16:11:13.4766667+00:00

    Hi, let me help you.

    The two highlighted rows are CDPUserSvc, which is the Connected Devices Platform User Service, and WpnUserService, which is the Windows Push Notifications User Service. Both are per-user versions of background services that Windows creates for each signed-in account, which is why you see that "_b359ebb0" suffix tacked onto the name.

    CDPUserSvc handles things like Continue on PC, Nearby Sharing, and syncing content between your devices. WpnUserService is what delivers push notifications from apps like Mail, Store apps, and other UWP apps to your Action Center. Both sit under the UnistackSvcGroup, which is a shared service host group Windows uses to bundle several lightweight user services into one process instead of running each separately.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-04T15:33:43.8933333+00:00

    Those are normal Windows per-user services.

    The suffix such as _b359ebb0 is a unique identifier added for that signed-in user session. Windows creates these services when a user signs in, and stops and deletes them when the user signs out. They are not, by themselves, a sign of malware.

    From the screenshot, examples include:

    • CDPUserSvc = Connected Devices Platform User Service
    • CloudBackupRestoreSvc = Cloud Backup and Restore Service
    • PimIndexMaintenanceSvc = Contact Data indexing

    Microsoft documents that per-user services run in the security context of the user account, and that different Windows versions can show different sets of these services.

    For the specific ones visible:

    • Connected Devices Platform User Service allows connecting, managing, and controlling connected devices.
    • Cloud Backup and Restore Service monitors changes in app and setting states and performs cloud backup and restore operations when required.
    • Contact Data indexes contact data for faster searching.

    If the concern is whether the suffix means a fake or replaced service, the documented behavior is that this suffix is expected for per-user services.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.