Multiple Svchost.exe in Task Manager; View Services Running Under Each Svchost.exe

Svchost.exe is a process that hosts Windows services to perform various functions. There can be multiple instances of svchost.exe (host process for Windows services) running on your computer, with each instance containing different services. Especially on Windows 10 v1709 and Windows 11, you might see 50+ Svchost.exe processes.

Using Task Manager, you can view the list of Services running under a particular svchost.exe process.

List Services Running Under Each Svchost.exe

Using Task Manager

1. Open Task Manager by right-clicking the taskbar and then clicking Task Manager.
2. Select the “Processes” tab, and click “Show processes from all users.”
3. Right-click on a svchost.exe process and click “Go to service(s).”
   
   This highlights services that are hosted by the svchost.exe process which you right-clicked on.
   

---

Using Command-line

Alternately, you can find the list of Services hosted by each svchost.exe process by running the tasklist /svc command from a Command Prompt window.

Or, even better.. to get the svchost.exe entries only, run the following command:

tasklist /svc /fi "imagename eq svchost.exe"

The output shows the service name (instead of the display name) adjacent to each svchost.exe process, such as below:

svchost.exe 2452 Dnscache
svchost.exe 2460 DoSvc
svchost.exe 2544 Wcmsvc
svchost.exe 2552 DusmSvc
svchost.exe 2676 BFE, mpssvc

To know the display name of a service — e.g., mpssvc, you can run the following command:

sc getdisplayname mpssvc

The output looks like this:

[SC] GetServiceDisplayName SUCCESS
Name = Windows Defender Firewall

(Or, you can look up the service display names here → Windows 10 Services listing & Windows 11 Services listing.)

---

Using Resource Monitor

1. Or, run the Resource Monitor (resmon.exe or perfmon.exe /res)
2. Click on the CPU tab and select a svchost.exe process from the list.
3. Under the Services section, you’ll see the list of services running under that particular instance of svchost.exe.
   

---

Process Explorer

You can easily view the list of services under each svchost.exe process using Windows Sysinternals Process Explorer.

1. In Process Explorer, sort the Process column ascending or descending.
2. Scroll down and select a svchost.exe process.
3. Right-click on the process and click Properties.
4. Click on the Services tab.
   

You’ll see the list of services grouped under that particular instance of svchost.exe

How the services are grouped is determined by the settings in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SVCHOST

When a svchost.exe process is launched with a specific parameter, it looks for a value (list of service names) of the same name under the above registry key. These services are loaded under that instance of svchost.exe.

Changes in Windows 10

Unlike earlier Windows Operating Systems, in Windows 10 and 11, each service would get its own service host (svchost.exe) instead of the services being grouped or hosted under a single svchost.exe. This change was first introduced in Windows 10 v1709 on systems with more than 3.5 GB of RAM.

However, even on systems with more than 3.5 GB of RAM, you may still see some svchost.exe process hosting four or more services in Windows 10. In earlier versions of Windows, you could easily see 10 or more services running under a single svchost.exe process (grouped), but that’s not always the case on Windows 10 and 11 systems.