Why Many Svchost.exe are Running in Windows 10 Creators Update

When you open the Details tab of the Task Manager in Windows 10 Creators Update, you will be surprised to see a huge number of instances of the svchost.exe process. Here is why the operating system needs so many SVCHOST processes and how you can identify which svchost process runs which group of services.
Windows is known for having a lot of svchost.exe processes. Even previous versions of the operating system like Windows 7 and Windows 8 had a large number of them. This is because the Svchost.exe executable file is used to run various system services. Each instance contains one or more services, i.e. a group of services. According to Microsoft, this model of service management allows reducing the memory consumption and reduces attack surface.

However, in Windows 10 Creators Update this service grouping model was changed.

Why So Many Svchost.exe Processes are Running in Windows 10 Creators Update

Starting with Windows 10 build 14942, services are no longer grouped if your PC has sufficient amount of memory. Now, for every service there is a dedicated svchost.exe process. This increases the number of Svchost.exe processes dramatically.

According to Microsoft, the memory-saving advantage of service hosts has diminished thanks to increased RAM size in modern devices. So, if a PC has 3.5+ GB of RAM installed, svchost won't group services any more. So don't be surprised to see 60+ instances of the svchost process in Task Manager.

The new service model has the following advantages:

  1. Increased reliability: If one service crashes, it won't affect other services or the host svchost.exe process. Even if the host svchost.exe process is terminated, other instances and their services will continue to work.
  2. Increased Transparency: the user can clearly see system resource usage for each service. You can use the Processes tab or the Details tab to see Memory, CPU, Disk and Network usage per service easily.
  3. Reduce servicing costs: Following reports of instability, service engineers, IT admins, and Microsoft engineers can rapidly pinpoint issues related to the exact service and fix it. Now it is easy to find out which service is giving issues and diagnose it.
  4. Increase security: Process isolation and individual permission sets for services will increase security.

If your PC has less than 3.5 GB of RAM, the classic service management model will be used. Services will be grouped like in previous versions of Windows.

Service groups are identified at the following Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

So, when Windows 10 uses service grouping, we will still see a number of instances of Svchost.exe, each running a group of services per instance, but just not as many as when it runs each service in its own svchost.exe process.

That's it.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won't take a lot from you, but it will help us grow. Thanks for your support!

Author: Sergey Tkachenko

Sergey Tkachenko is a software developer who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube.

15 thoughts on “Why Many Svchost.exe are Running in Windows 10 Creators Update”

  1. Is there any chance to avoid that?
    I’m really hating Win10 and all its huge stupid number of processes, so I won’t update to Creator Update with this number of svchost.exe processes!

    Yes, I hate multiprocess softwares!

      1. I’ve discovered a tweak to this. Open the registry editor and navigate to:
        Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
        Modify the following key:
        SvcHostSplitThresholdInKB
        Increase the value from 380000 to an amount just above the total RAM you have.
        Reboot, and no more 70+ processes showing! They’re now grouped like they were in earlier versions.

        1. @Glenn s.
          You wrote “Increase the value from 380000 to an amount just above the total RAM you have”.
          The total RAM I have? Do you mean in number of kilobytes, or, ?

          Thank you.

    1. The only thing that has changed is the way it splits. There’s no more stuff running in the background than earlier. It’s all placebo. After a certain amount of memory used, the process separates into more processes which will not slow down the system much. And has a lot of benefits stated above.

  2. Finally i understand this..
    I don’t really notice any increase in ram usage though
    Creators update is best win10 version so far.

  3. Can someone verify how many Mb of memory will be saved if you turn on/off this feature? On a regular workstation.

Leave a Reply

Your email address will not be published.

Exit mobile version
Using Telegram? Subscribe to the blog channel!
Hello. Add your message here.