
Get-Process cmdlet filtered by the process name ( ProcessName property of the collection returned by the cmdlet). In Windows PowerShell the first step is getting the list of all the svchost.exe instances running in the system, by executing the svc /fi "imagename eq svchost.exe" command. The taklist command can be used to get a tabular list of all the svchost processes running along with their process IDs and the names of all the services running within each instance: open a command prompt window and execute the tasklist Svchost.exe instance and click the ">" sign on the left to expand the list of the processes running within that instance. In the Windows 10 Task Manager it is also possible to click the Processes tab, look for the PID of the Then click the Services tab and click the "PID" column to apply again the ascending ordering to the list of services: find the PID number (528 in this example) and the corresponding service will be easily identified. The Windows Task Manager allows the user to determine the processes running within a specific instance of the svchost.exe process first click theĭetails tab, then click the "PID" column to order each running process by its PID (ascending order is the best way): in this example, look at the process whose PID is 528. Sometimes it could be necessary to know which processes are running within a specific instance of the Service Host process: there are several ways to get such an information using the operating system's built-in tools as well as additional tools: let's takeĪ look at.

There can be several instances of this special process running at any moment on a Windows system and each of them puts additional load on the system. The Windows Service Host process (also known as svchost, whose executable file is C:\WINDOWS\system32\svchost.exe) is a special process used by Windows to execute multiple instances of services and processes, started both from an executable (.EXE) file andįrom a dynamic link library (.DLL) file.
