Why Many Svchost.exe are Running in Windows 10 Creators Update

When you open the Details tab of the Task Manager in Windows 10 Creators Update, you will be surprised to see a huge number of instances of the svchost.exe process. Here is why the operating system needs so many SVCHOST processes and how you can identify which svchost process runs which group of services.

Windows is known for having a lot of svchost.exe processes. Even previous versions of the operating system like Windows 7 and Windows 8 had a large number of them. This is because the Svchost.exe executable file is used to run various system services. Each instance contains one or more services, i.e. a group of services. According to Microsoft, this model of service management allows reducing the memory consumption and reduces attack surface.

However, in Windows 10 Creators Update this service grouping model was changed.

Why So Many Svchost.exe Processes are Running in Windows 10 Creators Update

Starting with Windows 10 build 14942, services are no longer grouped if your PC has sufficient amount of memory. Now, for every service there is a dedicated svchost.exe process. This increases the number of Svchost.exe processes dramatically.

According to Microsoft, the memory-saving advantage of service hosts has diminished thanks to increased RAM size in modern devices. So, if a PC has 3.5+ GB of RAM installed, svchost won't group services any more. So don't be surprised to see 60+ instances of the svchost process in Task Manager.

The new service model has the following advantages:

  1. Increased reliability: If one service crashes, it won't affect other services or the host svchost.exe process. Even if the host svchost.exe process is terminated, other instances and their services will continue to work.
  2. Increased Transparency: the user can clearly see system resource usage for each service. You can use the Processes tab or the Details tab to see Memory, CPU, Disk and Network usage per service easily.
  3. Reduce servicing costs: Following reports of instability, service engineers, IT admins, and Microsoft engineers can rapidly pinpoint issues related to the exact service and fix it. Now it is easy to find out which service is giving issues and diagnose it.
  4. Increase security: Process isolation and individual permission sets for services will increase security.

If your PC has less than 3.5 GB of RAM, the classic service management model will be used. Services will be grouped like in previous versions of Windows.

Service groups are identified at the following Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

So, when Windows 10 uses service grouping, we will still see a number of instances of Svchost.exe, each running a group of services per instance, but just not as many as when it runs each service in its own svchost.exe process.

That's it.

10 thoughts on “Why Many Svchost.exe are Running in Windows 10 Creators Update

  1. OMC

    Is there any chance to avoid that?
    I’m really hating Win10 and all its huge stupid number of processes, so I won’t update to Creator Update with this number of svchost.exe processes!

    Yes, I hate multiprocess softwares!

    Poorly-rated. Like or Dislike: Thumb up 5 Thumb down 9

    Reply
    1. Sergey Tkachenko Post author

      Me too. I have not found a tweak to change this behavior yet.

      Poorly-rated. Like or Dislike: Thumb up 1 Thumb down 4

      Reply
      1. Glenn S.

        I’ve discovered a tweak to this. Open the registry editor and navigate to:
        Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
        Modify the following key:
        SvcHostSplitThresholdInKB
        Increase the value from 380000 to an amount just above the total RAM you have.
        Reboot, and no more 70+ processes showing! They’re now grouped like they were in earlier versions.

        Well-loved. Like or Dislike: Thumb up 7 Thumb down 0

        Reply
  2. Phil

    not good! it makes windows 10 slow since build 14942!

    Poorly-rated. Like or Dislike: Thumb up 1 Thumb down 7

    Reply
  3. MDJ

    I haven’t tried new memory management yet but I tend to believe in its potential.

    Like or Dislike: Thumb up 0 Thumb down 2

    Reply
  4. Alicia

    i hope it’s not too :(

    Like or Dislike: Thumb up 1 Thumb down 2

    Reply
  5. Alicia

    i hope it’s not going to* :(

    Like or Dislike: Thumb up 1 Thumb down 2

    Reply
  6. Balak

    its going to…i believe

    Like or Dislike: Thumb up 0 Thumb down 0

    Reply
  7. Tim Palo

    Good!

    Like or Dislike: Thumb up 2 Thumb down 0

    Reply
  8. jens nielsen

    Finally i understand this..
    I don’t really notice any increase in ram usage though
    Creators update is best win10 version so far.

    Like or Dislike: Thumb up 0 Thumb down 0

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *