Default SVCHOST.exe associated services, users and processes
Svchost.exe
Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.
Why Are There So Many svchost.exes Running?
If you’ve ever taken a look at the Services section in control panel you might notice that there are a lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on. (htt1)
List of process, Service, Description and Users
S# | Process | Services | Description | Users |
1 | Svchost.exe | power | power | system |
|
| PlugPlay | Plug and play | system |
|
| DcomLaunch | Dcom server process launcher | System |
2 | Svchost.exe | RpcSs | Remote procedure calls | Network service |
|
| RpcEptMapper | RPC Endpoint mapper | Network service |
3 | Svchost.exe | wscsvc | Security center | LocalServiceNetworkRestrict |
|
| lmhost | TCO/IP NetBIOS helper | LocalServiceNetworkRestrict |
|
| Event log | Window event log | LocalServiceNetworkRestrict |
|
| Dhcp | DHCP client | LocalServiceNetworkRestrict |
|
| Audiosrv | Window audio | LocalServiceNetworkRestrict |
4 | Svchost.exe | UxSms | Desktop Window Manager Session Manager | LocalSystemNetworkRestrict |
|
| UmRdpService | Remote Desktop Services User Mode Port Redirector | LocalSystemNetworkRestrict |
|
| TrkWks | Distributed link tracking client | LocalSystemNetworkRestrict |
|
| TableInputService | Tablet PC Input Service | LocalSystemNetworkRestrict |
|
| SysMain | SuperFetch | LocalSystemNetworkRestrict |
|
| PcaSvc | Program Compatibility Assistance service | LocalSystemNetworkRestrict |
|
| Netman | Network Connection | LocalSystemNetworkRestrict |
|
| CScService | Offline Files | LocalSystemNetworkRestrict |
5. | Svchost.exe | wuauserv | Window update | system |
|
| Winmgmt | Window Management Instrumentation | system |
|
| Themes | themes | system |
|
| ShellHWDetection | Shell hardware Detection | System |
|
| SessionEnv | Remote desktop configuration | system |
|
| SENS | System Event Notification | system |
|
| Schedule | Task Schedule | system |
6. | Svchost.exe | WdiServiceHost | Diagnostic Service Host | Local Services |
|
| W32Time | Window Time | LocalServices |
|
| sppuinotify | SPP Notification Service | LocalServices |
|
| nsi | Network Store InterFace Service | LocalServices |
|
| netprofm | Network List Service | LocalServices |
|
| EventSystem | COM+Event System | LocalService |
7. | Svchost.exe | Remote Desktop Services | Remote Desktop Services | NetworkService |
|
| NlaSvc | Network Location Awarness | NetworkService |
|
| LanManWorkstation | workstation | NetworkService |
|
| Dnscache | DNS client | NetworkService |
|
| CrypSvc | Cryptographic Services | NetworkService |
8 | Svchost.exe | FontCache | Window Font Cache Service | NetworkService |
9 | Svchost.exe | MpsSvc | Window Firewall | LocalServiceNoNetwork |
|
| DPS | Diagonastic Policy Service | LocalServiceNoNetwork |
|
| BFE | Base Filtering Engine | LocalServiceNoNetwork |
10 | Svchost.exe | SDRSVC | Windows Backup | system |
11 | Svchost.exe | Policy Argent | IPsec Policy Agent | LocalSystemNetworkRestrict |
|
|
|
|
|
Bibliography
(n.d.). Retrieved from http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/
AUTHOR: