Q. How can I view active Svchost-instance services in Windows Server 2008 or Windows Vista?

A. Run the Server 2008 or Vista built-in Tasklist command with the /svc switch to view the services running in each Svchost instance, as the following example demonstrates. You'll notice that a list of services is shown for each Svchost instance.

You would enter

Users\Administrator.SAVTSTDC01>tasklist /svc

The output would be:

Image Name            PID Services

============================================ System Idle Process 0 N/A System 4 N/A smss.exe 500 N/A csrss.exe 568 N/A wininit.exe 620 N/A csrss.exe 632 N/A services.exe 672 N/A winlogon.exe 704 N/A lsass.exe 720 KeyIso, ProtectedStorage, SamSs lsm.exe 728 N/A svchost.exe 896 DcomLaunch, PlugPlay svchost.exe 956 RpcSs svchost.exe 996 WinDefend svchost.exe 424 AudioSrv, Dhcp, EventLog, lmhosts svchost.exe 540 gpsvc svchost.exe 548 AeLookupSvc, Appinfo, BITS, CertPropSvc, EapHost, IKEEXT, iphlpsvc, LanmanServer, MMCSS, ProfSvc, RasMan, Schedule, seclogon, SENS, SessionEnv, ShellHWDectection, Themes, Winmgmt, wuauserv SLsvc.exe 12 slsvd svchost.exe 1028 EventSystem, FDResPub, LanmanWorkstation, netprofm, nsi, SCardSvr, SstpSvc, W32Time svchost.exe 1088 AudioEndpointBuilder, hidserv, Netman, UmRdpService, UxSms, WdiSystemHost, WPDBusEnum, wudfsvc svchost.exe 1112 TabletInputService svchost.exe 1176 CryptSvc, Dnscache, KtmRm, NlaSvc, TermService, WinRM svchost.exe 1272 Wlansvc audiolog.exe 1388 N/A svchost.exe 1424 BFE, DPS, MpsSvc svchost.exe 1488 WebClient taskeng.exe 1600 N/A spoolsv.exe 1728 Spooler
TAGS: Windows 8
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.