View Resources Usage by Individual Services in Windows 10

With the Windows 10 Creators Update (codenamed “Redstone 2”) Preview Build 14942, the way in which services are hosted has changed. In Windows 10 v1703 systems with more than 3.5 GB of RAM, each service would get its own service host (svchost.exe), instead of running under a shared service process. This lets you view the resources usage by each individual service. Resources here mean network, memory, disk and CPU usage.

Starting from Windows 2000 to up until Windows 10 v1607, each svchost.exe process used to host a set of services — a model originally designed to reduce resource usage by services. In the shared service process model, to find which services are running under each svchost.exe process, open Task Manager and click the chevron near “Service Host:” to expand the selection. You can see the list of service hosted by that process.

Or, use the Tasklist.exe command. Open a Command Prompt window and type:

tasklist /svc

This shows the list of services running under each instance of svchost.exe.

Separate Service Host (svchost.exe) for each Service

The above model has changed in Redstone 2, as the experts at Microsoft determined that the memory-saving advantage is not that substantial — given that systems are equipped with more than sufficient RAM these days.

There are exceptions, though. System services which are deemed critical — the ones whose recovery require system restarts, and other select services will remain grouped. From what I’ve seen in the Creators Update Preview Builds, services that stay in groups are mentioned below:

• Set 1: BrokerInfrastructure, DcomLaunch, Power, SystemEventsBroker
• Set 2: BFE, CoreMessagingRegistrar, MpsSvc
• Set 3: OneSyncSvc_5235d, PimIndexMaintenanceSvc_5235d, UnistoreSvc_5235d, UserDataSvc_5235d
• Set 4: BITS, UsoSvc, wuauserv

Rest of the services are ungrouped — run in separate processes.

Windows 10 Creators Update might release somewhere around March 2017. If you’re a Windows 10 Insider running Build 14942 or higher, in a computer with more than 3.5 GB of RAM, you may have noticed those additional instances of svchost.exe. There may be around 70+ svchost.exe processes running. Whereas in Windows 10 v1607, the number of svchost.exe instances was in the 20s, depending on how many services are installed and running in the system.

Advantages of Running Services Ungrouped

As per Microsoft, ungrouping services provides these four advantages:

1. Increase reliability: If a service fails, only that instance of svchost.exe is taken down. Earlier, if one service failed, termination of svchost.exe causes other services to stop.

2. Increase Transparency: You can now track the system resources (Memory, CPU, Disk and Network usage) used by each service, from Task Manager’s Processes tab, or in the Details tab with command-line column enabled. The Command-line column in the Processes or Details tab would show the short name of the service.

svchost.exe -k <svchost name> -s <service name>

For example:

svchost.exe -k netsvcs -s winmgmt

where “winmgmt” is the short name for the “Windows Management Instrumentation” service.

Previously, to troubleshoot service failures and crashes or CPU usage spikes caused by svchost.exe, you needed to use advanced methods. Some of the methods include service isolation (using sc.exe command-line) to configure a service to run in a separate host process, or creating a separate service group, and using advanced troubleshooting tools to identify and diagnose the individual service that’s causing the problem. See Svchost.exe troubleshooting.

In Windows 10 Redstone 2 systems with 3.5+ GB of RAM, since the services run under separate svchost.exe process already, you can know which particular service is causing a problem, and take action accordingly. Problems include 100% CPU usage, or high memory usage and repeated crashes.

3. Reduce servicing costs: Increased transparency of service processes would make troubleshooting easier. Technical support engineers can narrow down issues to the individual service and fix it quickly, which translates to reduced servicing costs.

4. Increase security: Process isolation and individual permission sets for services will enhance the security.

Conclusion: So, after you install the Windows 10 Creators Update (coming in 2017), don’t panic if you see 70+ instances of svchost.exe in Task Manager.