Svchost.exe is a process that hosts Windows services to perform various functions. There can be multiple instances of svchost.exe (host process for Windows services) running on your computer, with each instance containing different services. Especially on Windows 10 v1709 and Windows 11, you might see 50+ Svchost.exe processes.
Using Task Manager, you can view the list of Services running under a particular svchost.exe process.
List Services Running Under Each Svchost.exe
Using Task Manager
- Open Task Manager by right-clicking the taskbar and then clicking Task Manager.
- Select the “Processes” tab, and click “Show processes from all users.”
- Right-click on a
svchost.exeprocess and click “Go to service(s).”
This highlights services that are hosted by the
svchost.exeprocess which you right-clicked on.
Alternately, you can find the list of Services hosted by each svchost.exe process by running the
tasklist /svc command from a Command Prompt window.
Or, even better.. to get the svchost.exe entries only, run the following command:
tasklist /svc /fi "imagename eq svchost.exe"
The output shows the service name (instead of the display name) adjacent to each svchost.exe process, such as below:
svchost.exe 2452 Dnscache svchost.exe 2460 DoSvc svchost.exe 2544 Wcmsvc svchost.exe 2552 DusmSvc svchost.exe 2676 BFE, mpssvc
To know the display name of a service — e.g.,
mpssvc, you can run the following command:
sc getdisplayname mpssvc
The output looks like this:
[SC] GetServiceDisplayName SUCCESS Name = Windows Defender Firewall
Using Resource Monitor
- Or, run the Resource Monitor (
- Click on the CPU tab and select a svchost.exe process from the list.
- Under the Services section, you’ll see the list of services running under that particular instance of svchost.exe.
You can easily view the list of services under each svchost.exe process using Windows Sysinternals Process Explorer.
- In Process Explorer, sort the Process column ascending or descending.
- Scroll down and select a svchost.exe process.
- Right-click on the process and click Properties.
- Click on the Services tab.
You’ll see the list of services grouped under that particular instance of svchost.exe
How the services are grouped is determined by the settings in the following registry key:
When a svchost.exe process is launched with a specific parameter, it looks for a value (list of service names) of the same name under the above registry key. These services are loaded under that instance of svchost.exe.
Changes in Windows 10
Unlike earlier Windows Operating Systems, in Windows 10 and 11, each service would get its own service host (svchost.exe) instead of the services being grouped or hosted under a single svchost.exe. This change was first introduced in Windows 10 v1709 on systems with more than 3.5 GB of RAM.
However, even on systems with more than 3.5 GB of RAM, you may still see some svchost.exe process hosting four or more services in Windows 10. In earlier versions of Windows, you could easily see 10 or more services running under a single svchost.exe process (grouped), but that’s not always the case on Windows 10 and 11 systems.
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!