WINDOWS SERVICE

icssvc: Windows Mobile Hotspot Service

Q: How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k LocalServiceNetworkRestricted -p, runs as LocalService and loads C:\Windows\System32\tetheringservice.dll, signed by Microsoft Windows. It depends on RpcSs and Wcmsvc and has a trigger registered.

Provides the ability to share a cellular data connection with another device.

TECHNICAL SUMMARY

Service name	icssvc
Display name	Windows Mobile Hotspot Service
Runs from	C:\Windows\System32\svchost.exe
Command line	svchost.exe -k LocalServiceNetworkRestricted -p
Runs as	LocalService
Verdict	Depends on what you use
Microsoft, Windows Server 2016 guidance	OK to disable

Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.

Should you touch it?

Depends on what you use

Both of Microsoft's lists rate it OK to disable. If you share a cellular data connection from this PC with other devices, leave it. Its default startup type is Manual and it has a start trigger: on the PC used for this page it was stopped.

What PC Tweaker does with it

PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.

Check it yourself

See its state and start type

Get-Service icssvc | Format-List Name, DisplayName, Status, StartType
sc qc icssvc

PowerShell

02
Let it start only when needed (administrator)
Note the START_TYPE that sc qc printed first, so you can put it back.
```
sc config icssvc start= demand
```
cmd

Put it back

Use the start type you noted.

sc config icssvc start= <auto|delayed-auto|demand>

cmd

Common questions

What does the icssvc service do?

Provides the ability to share a cellular data connection with another device. It runs C:\Windows\System32\svchost.exe (svchost.exe -k LocalServiceNetworkRestricted -p) as LocalService.

Can I disable icssvc?

Depends on what you use. Both of Microsoft's lists rate it OK to disable. If you share a cellular data connection from this PC with other devices, leave it. Its default startup type is Manual and it has a start trigger: on the PC used for this page it was stopped.

Is icssvc the same as Internet Connection Sharing (SharedAccess)?

They are two services. Microsoft describes icssvc (Windows Mobile Hotspot Service) as the ability to share a cellular data connection with another device, and SharedAccess (Internet Connection Sharing) as network address translation, addressing and name resolution for a home or small office network.

How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k LocalServiceNetworkRestricted -p, runs as LocalService and loads C:\Windows\System32\tetheringservice.dll, signed by Microsoft Windows. It depends on RpcSs and Wcmsvc and has a trigger registered.