Skip to content

WINDOWS SERVICE

CaptureService: Capture Service

A per-user service that enables optional screen capture functionality for applications that call the screen capture APIs of the Windows.Graphics.Capture namespace.

TECHNICAL SUMMARY

Service nameCaptureService
Display nameCapture Service
Runs fromC:\Windows\System32\svchost.exe
Command linesvchost.exe -k LocalService -p
Runs asThe signed-in user
VerdictDepends on what you use

Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.

Should you touch it?

Depends on what you use

Microsoft's guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices rates it OK to disable. On a PC, an app that captures a window or the screen through those Windows APIs depends on it, so leave it if you use such apps. Its default startup type is Manual: on the PC used for this page the instance for the signed-in user was running.

What PC Tweaker does with it

PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.

Check it yourself

  1. See its state and start type

    Get-Service CaptureService | Format-List Name, DisplayName, Status, StartType
sc qc CaptureService
    PowerShell

  2. Let it start only when needed (administrator)

    Note the START_TYPE that sc qc printed first, so you can put it back.

    sc config CaptureService start= demand
    cmd

  3. Put it back

    Use the start type you noted.

    sc config CaptureService start= <auto|delayed-auto|demand>
    cmd

Common questions

What does the CaptureService service do?

A per-user service that enables optional screen capture functionality for applications that call the screen capture APIs of the Windows.Graphics.Capture namespace. It runs C:\Windows\System32\svchost.exe (svchost.exe -k LocalService -p) as The signed-in user.

Can I disable CaptureService?

Depends on what you use. Microsoft's guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices rates it OK to disable. On a PC, an app that captures a window or the screen through those Windows APIs depends on it, so leave it if you use such apps. Its default startup type is Manual: on the PC used for this page the instance for the signed-in user was running.

Why does the name end in random characters, like CaptureService_67db3c?

It is a per-user service. Microsoft documents that Windows shows each one as the service name, an underscore and a locally unique identifier for the user context. The suffix differs between PCs and sign-ins; it is not a sign of malware.

How do I check that it is the real service?

On Windows 11 build 26300 the template is registered as svchost.exe -k LocalService -p, loads C:\Windows\System32\CaptureService.dll, signed by Microsoft Windows, and depends on RpcSs. The running instance was hosted by svchost.exe -k LocalService -p -s CaptureService.