What is svchost.exe In The Task Manager


What is svchost.exe? Anyone who has ever looked in their Task manager under the Processes tab has no doubt seen the process svchost.exe running. You might also have noticed it is running multiple times. The Svchost.exe file resides in the %SystemRoot%System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.

So What is svchost.exe

Svchost.exe groups are identified in the following registry key:


Each value under this key represents a different group of Svchost and appears as a separate instance when you are viewing active processes. Each is a REG_MULTI_SZ value and contains services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:

  1. Click Start on the Windows taskbar, and then click Run.
  2. In the Open box, type CMD, and then click OK.
  3. Type Tasklist /SVC, and then press the enter key.

Tasklist displays a list of processes currently running. By typing /SVC after Tasklist, it shows a list of active services in each process.

You can effectively reduce the number of svchost.exe instances that run by disabling these services in the Administrative Tools area of the Control Panel. If you know the services that belong to that instance or svchost.exe does not need to run, you can disable it. Having too many services running unnecessarily can result in your computer running slow.

So what services do you disable? If you’re running Vista or Windows 7, hit CTRL+ALT+Delete and open the task manager, click on the Processes tab and look for an instance of svchost.exe. Right-click it and select “Go to Services.” You will get a detail description of what is using the svchost.exe service and make a determination on whether it should be disabled or not. In most cases, you will probably opt to just let it run.

What is svchost.exe Concluded

So Svchost.exe is a process on your computer that hosts other services Windows uses to perform various functions. Among others, Windows Defender uses a service that is hosted by a svchost.exe process. There can be multiple instances of svchost.exe running on your PC, with each containing different services. One instance of svchost.exe could host a single service for a program, and another instance could host several services related to Windows. Use Task Manager to view which services are running under each instance of svchost.exe.

Leave a Comment

Scroll to Top