Understanding Windows 2000 Server’s Svchost.exe process

If you run the Task Manager and go to the Processes tab, you may see several processes with the name Svchost.exe; this is a feature, not a bug. Now look at the PID column, and you’ll notice that each process named Svchost.exe has a different Process ID. So they’re actually different processes—they just all have the same Image Name.

Svchost.exe is a placeholder for several services. In previous versions, each service was running within its own image and consumed more memory. Grouping services into a host process allows Microsoft to set security restrictions to a group of services and save memory.

If you want to see which services are running under each instance of Svchost.exe, then run the Tlist.exe utility, which is part of Windows 2000 Support Tools. Go to the /support/tools folder on your Windows 2000 CD and run Setup.exe to install the tools. Once the tools are installed, type tlist -s in the command prompt. You’ll get a list of all services running on your system and a list of services running inside Svchost.exe

Advertisements