Applies to:

Windows 7

Windows Server 2008 R2

Windows Vista

Windows Server 2008

Windows XP

Windows Server 2003

Windows 2000

Windows 2000 Server

How to troubleshoot Service Host (svchost.exe) related problems:

  • High cpu
  • Memory leaks (private bytes leaks and/or virtual bytes leaks)
  • Handle leaks.

History of svchost.exe

In Windows NT 4.0, the different services were under their own .exe’s.

clip_image001

For example above, we could see that the following services had their own executables:

Spoolss.exe (Print Spooler)

Rpcss.exe (Remote Procedure Call)

Tapisrv.exe (Telephony)

What is a svchost.exe?

Starting with Windows 2000, since each process consumes resources (desktop heap, memory, disk space, etc…), we moved the individual services to a generic service host.

Svchost stands for “Service Host” which hosts services.

The Services are compiled as .dll’s. Since it is a service, it will run in the background until it is needed even without any user being logged on or if the system is shutdown.

clip_image002

Above you will notice that there are 17 svchost.exe processes running.

It is nicely described in these links:

In the figure above, all the svchost.exe processes seem identical; let’s find out what the Process ID (PID) and the User Names are for the different svchost.exe’s.

In Task Manager, let’s click on “View” and then on “Select Columns”.

clip_image003

Check the boxes next to:

PID (Process Identifier)

and

User Name

clip_image004

Now, what you should be seeing is the following:

clip_image005

The svchost.exe’s processes are organized in logical groups. These logical groups are usually grouped by the accounts that are needed.

i.e.

System

Local Service

Network Service

How do you find out which service is running in all these different svchost.exe processes?

In Windows 2000, Windows 2000 Server, Windows XP and Windows Server 2003:

Click on Start, Run, cmd.exe

Type “tlist /svc /fi “imagename eq svchost.exe”

Note: The output will provide the names in shortnames which are used with the Service Control Manager command (SC.exe), also the way that they are in the registry HKLM\System\CurrentControlSet\Control\Services.

In Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2:

Within Task Manager, right click on the svchost.exe that you are interested.

Click on “Go to Service(s)”:

clip_image006

clip_image007

In the “Services tab”, it will highlight the services that are running under that particular svchost.exe as show above.

Note: You will see the full name of the service under the “Description” column.

Click on Start, cmd.exe (Run as admin)

clip_image008

Type “tasklist /svc /fi “imagename eq svchost.exe”

clip_image010

Note: The output will provide the names in shortnames which are used with the Service Control Manager command (SC.exe), also the way that they are in the registry HKLM\System\CurrentControlSet\Control\Services

Using Process Explorer to find the services that are running under the svchost.exe processes.

You could hover over the svchost.exe that you are interested in and you will see the following info:

  • Command line
  • Path
  • Services

clip_image011

If you want to go a step further, instead of using services.msc, you could start or stop the services by doing the following within Process Explorer:

Right click on the svchost.exe and click on “Properties…”

clip_image012

Click on the “Services” tab which will provide with the “Stop”, “Pause” and “Resume” options.

clip_image013

How to start or stop the service by using the command prompt or powershell:

clip_image015

Type “net start /?” without the quotation marks and then Press Enter.

You could see that the syntax is “net start ServiceName”

i.e. net start dnscache

clip_image017

Type “net stop /?” without the quotation marks and then Press Enter.

You could see that the syntax is “net stop ServiceName”

i.e. net stop dnscache

How to set the service to “Automatic (Delayed Start)”, or “Automatic”, or “Manual”, or “Disabled”.

In Services.msc, you could double click on the service that you are troubleshooting and click on the drop down menu for “Startup type:”.

clip_image018

You could accomplish the same task by using the command prompt or powershell:

Click on Start, CMD (Run as admin)

clip_image020

Type “sc config /?” without the quotation marks and then press Enter.

In this output, you will see the options for start which are boot, system, auto, demand, disabled and delayed-auto.

To enable a service from the command line:

Type “sc config ServiceName start= start”

Note: Where ServiceName is the actual service name.

Note 2: There is a space between start= and start. This is a gotcha for a lot of folks.

i.e. Type “sc config dnscache start= start”

To disable a service from the command line:

Type “sc config ServiceName start= disable”

Note: Where ServiceName is the actual service name.

Note 2: There is a space between start= and start. This is a gotcha for a lot of folks.

i.e. Type “sc config dnscache start= disable”

This list contains a summary that relates Windows services to the files that implement them, and to the components that provide those files. This is not an exhaustive listing.

Windows service

File name

Component name

Alerter

AlrSvc.dll

This service runs within the context of SvcHost.exe.

Alerter Service

Application Layer Gateway Service

AppMgmts.dll

This service runs within the context of SvcHost.exe.

Software Installation Group Policy Extension

Automatic Updates

WuauServ.dll

This service runs within the context of SvcHost.exe.

Windows Update Agent

Background Intelligent Transfer Service

Qmgr.dll

This service runs within the context of SvcHost.exe.

Background Intelligent Transfer Service

COM+ Event System

Es.dll

This service runs within the context of SvcHost.exe.

COM+ Services

Computer Browser

Browser.dll

This service runs within the context of SvcHost.exe.

Computer Browser Service

Cryptographic Services

CryptSvc.dll

This service runs within the context of SvcHost.exe.

Core Certificate Services

DHCP Client

DhcpcSvc.dll

This service runs within the context of SvcHost.exe.

DHCP Client Service

DNS Client

DHCPSvc.dll

This service runs within the context of SvcHost.exe.

DHCP Client Service

Error Reporting Service

ErSvd.dll

This service runs within the context of SvcHost.exe.

Error Reporting

Event Log

EventLog.dll

This service runs within the context of Services.exe.

Event Log

Fast User Switching Compatibility

Shsvcs.dll

This service runs within the context of SvcHost.exe.

User Interface

Help and Support

HelpSvc.exe

This service runs within the context of SvcHost.exe.

Help and Support Services

Human Interface Device Access

HidServ.dll

This service runs within the context of SvcHost.exe.

In Target Designer, all components under Hardware | Devices | Human Interface Devices

Internet Connection Firewall (ICP) / Internet Connection Sharing

Fwcfg.dll

This service runs within the context of SvcHost.exe.

Windows Firewall/Internet Connection Sharing (ICS)

Logical Disk Manager

DmServer.dll

This service runs within the context of SvcHost.exe.

Disk Management Services

Messenger

MsgSvc.dll

This service runs within the context of SvcHost.exe.

Messenger Service (Net Send)

Network Connections

Netman.dll

This service runs within the context of SvcHost.exe.

Primitive: Netman

Network Location Awareness (NLA)

Mswsock.dll

This service runs within the context of SvcHost.exe.

Network Location Awareness Service

Portable Media Serial Number

Mspmsnsv.dll

This service runs within the context of SvcHost.exe.

Windows Media Player 10 Technologies

Remote Access Auto Connection Manager

Rasmans.dll

This service runs within the context of SvcHost.exe.

Dial-Up Networking Common Libraries

Remote Access Connection Manager

SessMgr.exe

This service runs within the context of SvcHost.exe.

Terminal Services Remote Assistance Component

Remote Procedure Call (RPC)

Rpcss.dll

This service runs within the context of SvcHost.exe.

RPC Server

Remote Registry

RegSvc.dll

This service runs within the context of SvcHost.exe.

Remote Registry Service

Removable Storage

Ntmssvc.dll

This service runs within the context of SvcHost.exe.

Removable Storage Service

Routing and Remote Access

Mprdim.dll

This service runs within the context of SvcHost.exe.

Dial-up Server for Windows

Secondary Logon

SecLogon.dll

This service runs within the context of SvcHost.exe.

RunAs Service

Server

SrvSvc.dll

This service runs within the context of SvcHost.exe.

File Sharing

Shell Hardware Detection

ShSvcs.dll

This service runs within the context of SvcHost.exe.

User Interface Core

SSDP Discovery Service

SsdpSrv.dll

This service runs within the context of SvcHost.exe.

Universal Plug & Play

System Event Notification

Sens.dll

This service runs within the context of SvcHost.exe.

System Event Notification Service (SENS)

System Restore Service

SrSvc.dll

This service runs within the context of SvcHost.exe.

System Restore Core

Task Scheduler

SchedSvc.dll

This service runs within the context of SvcHost.exe.

Task Scheduler

TCP/IP NetBIOS Helper

ImhSvc.dll

This service runs within the context of SvcHost.exe.

NetBIOS over TCP/IP

Telephony

TapiSrv.dll

This service runs within the context of SvcHost.exe.

Telephony

Terminal Services

TermSrv.dll

This service runs within the context of SvcHost.exe.

Terminal Services Core

Themes

UxTheme.dll

This service runs within the context of SvcHost.exe.

Primitive: Uxtheme

Universal Plug and Play Device Host

UPnPHost.dll

This service runs within the context of SvcHost.exe.

Universal Plug & Play Device Host

WebClient

Webclnt.dll

This service runs within the context of SvcHost.exe.

Webdav Client Redirector

Windows Audio

AudioSrv.dll

This service runs within the context of SvcHost.exe.

Microsoft Audio Compression Manager (MME Core)

Windows Image Acquisition (WIA)

WIAservc.dll

This service runs within the context of SvcHost.exe.

Windows Image Acquisition Core

Windows Management Instrumentation

WMIsvc.dll

This service runs within the context of SvcHost.exe.

WMI Core

Windows Management Instrumentation Driver Extensions

Advapi32.dll

This service runs within the context of SvcHost.exe.

Windows API - Advanced

Windows Time

W32Time.dll

This service runs within the context of SvcHost.exe.

Time Service Core

Wireless Zero Configuration

WzcSvc.dll

This service runs within the context of SvcHost.exe.

Primitive: Wzcsvc

Workstation

WksSvc.dll

This service runs within the context of SvcHost.exe.

Workstation Service

Troubleshooting svchost.exe issues:

Before you ever start troubleshooting anything, as always please make sure that you have a complete backup of your system.

Note: Backing up is the easy portion, have you tried restoring and making sure that it works? Most folks don’t, and they end up with a backup that is just taking disk space.

Shotgun approach (not recommended):

Stop the services for the svchost.exe

Recommended troubleshooting:

Step 1. Find the Process ID of the svchost.exe that is causing the high cpu, memory leak (private bytes (a.k.a. heap) or virtual bytes) or handle leaks.

Using Task Manager or Process Explorer find the svchost.exe that is causing the problem.

Write down the PID

Step 2. Which services are running in that particular SVCHOST.exe?

Using Task Manager or Tasklist or Process Explorer find the services that are running in that particular svchost.exe.

Step 3. Separate the services for that particular SVCHOST.exe

clip_image022

Click on Start, CMD (Run as admin)

Type “Sc.exe config ServiceName Type= own” without the quotation marks and then press Enter.

Type “Net stop ServiceName” without the quotation marks and then press Enter.

Type “Net start ServiceName” without the quotation marks and then press Enter.

To put the service back to the shared service host:

Type “Sc.exe config ServiceName Type= share” without the quotation marks and then press Enter.

Type “Net stop ServiceName” without the quotation marks and then press Enter.

Type “Net start ServiceName” without the quotation marks and then press Enter.

Related reading:

How to separate out .DLL based services that use a shared generic service host process name (svchost.exe) for troubleshooting…

http://blogs.msdn.com/b/windowsvistanow/archive/2009/01/30/how-to-separate-out-dll-based-services-that-use-a-shared-generic-service-host-process-name-svchost-exe-for-troubleshooting.aspx

Note: On Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2

There are always exceptions, in this case, WinMgmt (Windows Management Instrumentation) is unique.

To break WMI to its own svchost.exe:

Click on Start, CMD (Run as admin)

Type “Winmgmt.exe /standalonehost” without the quotation marks and then press Enter.

clip_image024

Type “Net stop winmgmt” without the quotation marks and then press Enter.

Type “Net start winmgmt” without the quotation marks and then press Enter.

To put WMI on a shared svchost.exe:

Type “Winmgmt.exe /sharedhost” without the quotation marks and then press Enter.

clip_image026

Type “Net stop winmgmt” without the quotation marks and then press Enter.

Type “Net start winmgmt” without the quotation marks and then press Enter.

Depending on the issue that you are troubleshooting, there are different steps that you could take…

  • Access Violates (AV’s, better known as application crashes).
  • High CPU utilization
  • Private bytes leaks (heap leak)
    Virtual bytes leaks
  • Handle leaks.

In a future post, I’ll go over all these different scenarios.