WINDOWS SERVICE

SharedAccess: Internet Connection Sharing (ICS)

Q: How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k netsvcs -p, runs as LocalSystem and loads C:\Windows\System32\ipnathlp.dll, signed by Microsoft Windows. It depends on BFE (Base Filtering Engine) and has a trigger registered.

Provides network address translation, addressing, name resolution and intrusion prevention services for a home or small office network.

TECHNICAL SUMMARY

Service name	SharedAccess
Display name	Internet Connection Sharing (ICS)
Runs from	C:\Windows\System32\svchost.exe
Command line	svchost.exe -k netsvcs -p
Runs as	LocalSystem
Verdict	Depends on what you use
Microsoft, Windows Server 2016 guidance	OK to disable (required for clients used as Wi-Fi hotspots and both ends of Miracast projection)

Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.

Should you touch it?

Depends on what you use

Both of Microsoft's lists rate it OK to disable, and the Windows Server list adds what needs it: clients used as Wi-Fi hotspots, and both ends of Miracast projection. If you share this PC's connection or project wirelessly, leave it. Its default startup type is Manual; on the PC used for this page it was running.

What PC Tweaker does with it

PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.

Check it yourself

See its state and start type

Get-Service SharedAccess | Format-List Name, DisplayName, Status, StartType
sc qc SharedAccess

PowerShell

02
Let it start only when needed (administrator)
Note the START_TYPE that sc qc printed first, so you can put it back.
```
sc config SharedAccess start= demand
```
cmd

Put it back

Use the start type you noted.

sc config SharedAccess start= <auto|delayed-auto|demand>

cmd

Common questions

What does the SharedAccess service do?

Provides network address translation, addressing, name resolution and intrusion prevention services for a home or small office network. It runs C:\Windows\System32\svchost.exe (svchost.exe -k netsvcs -p) as LocalSystem.

Can I disable SharedAccess?

Depends on what you use. Both of Microsoft's lists rate it OK to disable, and the Windows Server list adds what needs it: clients used as Wi-Fi hotspots, and both ends of Miracast projection. If you share this PC's connection or project wirelessly, leave it. Its default startup type is Manual; on the PC used for this page it was running.

What stops working if I disable Internet Connection Sharing?

Microsoft names two things that require it: using the PC as a Wi-Fi hotspot, and Miracast projection, on both ends. Its description also covers network address translation and addressing for a home or small office network.

How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k netsvcs -p, runs as LocalSystem and loads C:\Windows\System32\ipnathlp.dll, signed by Microsoft Windows. It depends on BFE (Base Filtering Engine) and has a trigger registered.