Default SVCHOST.exe associated services, users and processes

Default SVCHOST.exe associated services, users and processes

Svchost.exe

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on. (htt1)

List of process, Service, Description and Users

S#	Process	Services	Description	Users
1	Svchost.exe	power	power	system
		PlugPlay	Plug and play	system
		DcomLaunch	Dcom server process launcher	System
2	Svchost.exe	RpcSs	Remote procedure calls	Network service
		RpcEptMapper	RPC Endpoint mapper	Network service
3	Svchost.exe	wscsvc	Security center	LocalServiceNetworkRestrict
		lmhost	TCO/IP NetBIOS helper	LocalServiceNetworkRestrict
		Event log	Window event log	LocalServiceNetworkRestrict
		Dhcp	DHCP client	LocalServiceNetworkRestrict
		Audiosrv	Window audio	LocalServiceNetworkRestrict
4	Svchost.exe	UxSms	Desktop Window Manager Session Manager	LocalSystemNetworkRestrict
		UmRdpService	Remote Desktop Services User Mode Port Redirector	LocalSystemNetworkRestrict
		TrkWks	Distributed link tracking client	LocalSystemNetworkRestrict
		TableInputService	Tablet PC Input Service	LocalSystemNetworkRestrict
		SysMain	SuperFetch	LocalSystemNetworkRestrict
		PcaSvc	Program Compatibility Assistance service	LocalSystemNetworkRestrict
		Netman	Network Connection	LocalSystemNetworkRestrict
		CScService	Offline Files	LocalSystemNetworkRestrict
5.	Svchost.exe	wuauserv	Window update	system
		Winmgmt	Window Management Instrumentation	system
		Themes	themes	system
		ShellHWDetection	Shell hardware Detection	System
		SessionEnv	Remote desktop configuration	system
		SENS	System Event Notification	system
		Schedule	Task Schedule	system
6.	Svchost.exe	WdiServiceHost	Diagnostic Service Host	Local Services
		W32Time	Window Time	LocalServices
		sppuinotify	SPP Notification Service	LocalServices
		nsi	Network Store InterFace Service	LocalServices
		netprofm	Network List Service	LocalServices
		EventSystem	COM+Event System	LocalService
7.	Svchost.exe	Remote Desktop Services	Remote Desktop Services	NetworkService
		NlaSvc	Network Location Awarness	NetworkService
		LanManWorkstation	workstation	NetworkService
		Dnscache	DNS client	NetworkService
		CrypSvc	Cryptographic Services	NetworkService
8	Svchost.exe	FontCache	Window Font Cache Service	NetworkService
9	Svchost.exe	MpsSvc	Window Firewall	LocalServiceNoNetwork
		DPS	Diagonastic Policy Service	LocalServiceNoNetwork
		BFE	Base Filtering Engine	LocalServiceNoNetwork
10	Svchost.exe	SDRSVC	Windows Backup	system
11	Svchost.exe	Policy Argent	IPsec Policy Agent	LocalSystemNetworkRestrict

Bibliography

(n.d.). Retrieved from http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

 AUTHOR:

Lubna Shamsher