During the installation of a server operating system, it is possible to install applications and services supplied with it, some of which may not be used at all. Software that is tested briefly, but no longer needed afterwards is often installed during later operations, as well. Employees are frequently unaware that these unused applications and services are available. As a result, numerous unused applications and services may be placing an unnecessary load on a server.

In addition, these unused applications and services may contain vulnerabilities, such as when they are no longer updated. If the applications and services installed are not known, the organisation in question will not be aware of the fact that they must also be updated. This means they can easily become a gateway for attackers.