summary: Disabling the Messenger Service in Windows NT/2000/XP
  last updated: Saturday, October 12, 2002
   prepared by: wje
 test hardware: Dell Optiplex
       test OS: XP professional, Version 2002 and Windows 2000

------------
Overview
------------
The Messenger service is used to send and transmit messages in the
form of pop-up alert boxes between Windows computers or by the Alerter
service.  The Messenger service is not related to the Windows instant
messaging facility called Windows Messenger.  The Windows Messenger
service is normally running by default.  With this service enabled,
remote hosts, users or attackers are able to generate unsolicited
pop-up message boxes on a host as a form of spam or denial of service
attack.

------------
Requirements
------------
To stop or start the Messenger service, you must be logged on as
Administrator or a user that is a member of the Administrators group.

-------------
Configuration
-------------
From the Windows desktop, click:

   # For Windows 2000 and Windows XP using the Windows Classic theme:
   1a. Start -> Settings -> Control Panel -> Administrative Tools ->
       Services

   # For Windows XP using the Windows XP theme:
   1b. Start -> Settings -> Control Panel -> Performance and Maintenance ->
       Administrative Tools -> Services 

   2. Scroll down and highlight "Messenger".

   3. Right-click the highlighted line and choose Properties. 

   4. Under Startup Type choose 'Disabled' or 'Manual' from the drop
      down menu.

   5. Click OK.

---------------
Troubleshooting
---------------
Disabling the Messenger service may effect other services from operating
properly. To determine if having disabled the Messenger service is the
source of a problem, re-enable the Messenger service  Follow these steps:

   1. From the Windows desktop click:

      # For Windows 2000 and Windows XP using the Windows Classic theme:
      Start -> Settings -> Control Panel -> Administrative Tools ->
      Services 

      # For Windows XP using the Windows XP theme:
      Start -> Settings -> Control Panel -> Performance and Maitenance ->
      Administrative Tools -> Services

   2. Scroll down and highlight "Messenger".

   3. Right-click the highlighted line and choose Properties. 

   4. Under Startup Type choose 'Automatic' from the drop down menu.

   5. Click OK 

-----
Notes 
-----
Normally it is safe to disable this service.  Note, that the Windows
Alerter service may depend on the Windows Messenger service to be enabled
in order to operate properly in some environments.

The 'NET SEND' command is the command line utility used to send messages
between Windows computers using the Messenger service.  The syntax for
the 'NET SEND' command is as follows:

  NET SEND {name | * | /DOMAIN[:name] | /USERS} message

Normally the 'NET SEND' command is used to send messages to the Windows
computer name in a Microsoft Windows networking enviornment.  There are
however third party utilities available that can send messages to the
Messenger service using IP addresses and DNS entries in order to cross
IP subnets and administrative network domains.

----------
References
----------
Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q168893

-------
Changes
-------
2002-10-11  Initial creation date
2002-10-12  minor updates and editing (jtk)