Which Windows Service is hiding behind the process SvcHost.exe?

Titel_ImageToday I am troubleshooting a Windows 2012 R2 server. This server shows a high CPU load for the process “SvcHost.exe” after a reboot. There are multiple instances for this process, all with different process id and different CPU and memory usage percentages.

In the Windows NT family of operating systems, svchost.exe (Service Host) is a system process that hosts multiple Windows services. SVCHost is important for the implementation of shared service processes, where a number of services can share a process to reduce resource consumption. This explains why there are different instances for this process.

For me to troubleshoot this issue it is important to find out which of the Windows Services is causing this behavior.

The svchost process was introduced in Windows 2000, but the underlying support for shared services has existed since Windows NT 3.1.

To indentify which Windows Service is causing the peak CPU usage I execute the following code on the command line:

tasklist /svc /fi “IMAGENAME eq svchost.exe”

Blog_SvcHost

 

Now I can identify which service or group of services I have to investigate.