How to See Which Services Are Running Inside svchost.exe in Windows 11 and 10

Is one svchost.exe eating your CPU, or are you staring at dozens of them in Task Manager wondering what they are? The quickest answer is Method 1 below: expand the Service Host entries in Task Manager’s Processes tab to see exactly which services each one runs. Every instance is a Service Host, a container Windows uses to run background services that can’t launch as standalone programs.

Method 1: Expand Service Host entries in the Processes tab

The Processes tab already labels every Service Host with the name of what’s inside. You just need to scroll to the right section.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. If you see the compact view, click More details at the bottom left.
3. Click the Processes tab.
4. Scroll past Apps and Background processes to the Windows processes section.
5. Look for entries labeled Service Host: followed by a service name (for example, Service Host: DHCP Client). There will be several.

6. Click the arrow next to any Service Host entry to expand it and see the individual services running inside that instance.
7. To jump to the underlying svchost.exe in the Details tab, right-click the Service Host entry and choose Go to details.

Task Manager switches to the Details tab with the corresponding svchost.exe row selected, showing its PID, CPU, and memory figures.

Method 2: Jump from the Details tab to the Services tab

If you’ve already spotted a misbehaving svchost.exe by PID in the Details tab, this route takes you straight to its hosted services.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Click the Details tab.
3. Scroll to the svchost.exe process you want to inspect.
4. Right-click it and choose Go to service(s).

Task Manager switches to the Services tab and highlights every service running inside that svchost.exe. From there you can right-click any highlighted service to stop, start, or restart it, or open the full services.msc console for more control.

Method 3: Use tasklist /svc in Command Prompt

The tasklist command is actually the smoothest approach when you need to search, copy, or save the output. Open Command Prompt as administrator (click Start, type cmd, right-click Command Prompt, select Run as administrator), then run:

tasklist /svc /fi "imagename eq svchost.exe"

The output table shows Image Name, PID, and a Services column listing everything hosted in each process.

To drill into one specific instance, say the one eating 40% CPU, note its PID in Task Manager first, then run:

tasklist /svc /fi "pid eq 1234"

Replace 1234 with the actual PID. The output lists exactly which services live in that instance and nothing else.

To save the full list to a file:

tasklist /svc /fi "imagename eq svchost.exe" > C:\Users\%username%\Documents\svchost-list.txt

Method 4: Process Explorer (Sysinternals)

Process Explorer is a free Microsoft tool that surfaces details Task Manager leaves out: command-line arguments, digital signatures, and the account each process runs under. No installation required; download, unzip, and run the EXE.

1. Run procexp64.exe (or procexp.exe on 32-bit systems).
2. Click the Process column header to sort alphabetically.
3. Scroll to the svchost.exe entries.
4. Hover over any entry to see a tooltip listing its hosted services.

You can also click the arrow next to a svchost.exe entry to expand it in the tree view. Same information, no hovering required.

Why are there so many svchost.exe processes?

Since Windows 10 version 1703, PCs with more than 3.5 GB of RAM isolate most services in their own dedicated Service Host processes rather than bundling many into a single shared container. The practical benefit is stability: if one service crashes, it takes down only its own process instead of a dozen others running alongside it. Microsoft’s own measurements put a typical split-services system at roughly 67 to 74 svchost.exe instances, so a long list is expected and normal.

Is svchost.exe safe?

The legitimate svchost.exe always runs from C:\Windows\System32\. Malware sometimes copies the filename but runs from a different path, such as C:\Users\, C:\Temp\, or similar locations. If something looks off, right-click the process in Task Manager or Process Explorer, choose Open file location, and verify the path. Run a full scan with your antivirus software if the executable isn’t in System32.

What to do when a Service Host is consuming too much CPU or disk

1. Open Task Manager (Ctrl + Shift + Esc) and click the CPU or Disk column header to sort by usage.
2. Find the Service Host entry at the top of the list.
3. Expand it to identify which specific service is the actual consumer.
4. Right-click that service and choose Stop to test whether the load drops.
5. If it does, open services.msc to adjust the service’s startup type or investigate further.

Windows Update and its background helper (BITS) generate heavy disk and CPU activity while downloading patches; letting them finish is usually the right call. SysMain, the disk-caching service, can push traditional hard drives to 100% disk usage on systems without SSDs; disabling it is safe to try if you’re on an HDD that’s constantly pegged. Network-related services like DHCP Client or DNS Client rarely cause sustained load, but if your router is struggling, they can spike briefly.

Which Method Should You Use?

Method 1, expanding Service Host entries in the Processes tab, handles most situations without leaving Task Manager. If you’re tracking a specific process by PID, the tasklist /svc /fi "pid eq 1234" command in Method 3 (with your PID in place of 1234) is faster than clicking around. Process Explorer is worth bookmarking for any situation where you need to verify a process’s digital signature or examine its startup parameters. If a Service Host keeps spiking after you’ve identified the culprit service, the service itself needs attention. Check its entries in Event Viewer for the real diagnosis.