svchost.exe C:\Windows\System32\svchost.exe

Generic host process for Windows services implemented as DLLs; several instances run, grouping services by group.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

svchost.exe (Service Host) is the host process for Windows services implemented as DLLs. The Service Control Manager starts several instances, each hosting one or more services, which is why Task Manager lists dozens of them. Since Windows 10 version 1703, on a machine with enough memory, many services are split into their own svchost.exe, which makes isolation and diagnosis easier.

What it contains

An executable signed by Microsoft in C:\Windows\System32.
Many instances, with a -k <group> command line (and sometimes -s <service>).
The hosted service and its DLL are described under HKLM\SYSTEM\CurrentControlSet\Services\<name>\Parameters (ServiceDll value).

Risks and best practices

Before terminating a svchost.exe, check which services it hosts (tasklist /svc): some are critical and cause a shutdown or restart.
The name is a classic malware disguise. The genuine file is in System32, signed, with services.exe as parent.
For abnormal consumption, identify the responsible service and act on it, not on the process.

Useful commands

# List the services hosted in each svchost.exe process
tasklist /svc /fi "imagename eq svchost.exe"

# See services whose path points to svchost, with the group
Get-CimInstance Win32_Service | Where-Object PathName -like "*svchost.exe*" | Select-Object Name, ProcessId, PathName

# Check the file's digital signature
Get-AuthenticodeSignature "$env:windir\System32\svchost.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# Check that each svchost has services.exe as parent
Get-CimInstance Win32_Process -Filter "Name='svchost.exe'" | Select-Object ProcessId, ParentProcessId, ExecutablePath

Report a mistake