Why Many Svchost.exe are Running in Windows 10 Creators Update

When you open the Details tab of the Task Manager in Windows 10 Creators Update, you will be surprised to see a huge number of instances of the svchost.exe process. Here is why the operating system needs so many SVCHOST processes and how you can identify which svchost process runs which group of services.
Windows is known for having a lot of svchost.exe processes. Even previous versions of the operating system like Windows 7 and Windows 8 had a large number of them. This is because the Svchost.exe executable file is used to run various system services. Each instance contains one or more services, i.e. a group of services. According to Microsoft, this model of service management allows reducing the memory consumption and reduces attack surface.

However, in Windows 10 Creators Update this service grouping model was changed.

Why So Many Svchost.exe Processes are Running in Windows 10 Creators Update

Starting with Windows 10 build 14942, services are no longer grouped if your PC has sufficient amount of memory. Now, for every service there is a dedicated svchost.exe process. This increases the number of Svchost.exe processes dramatically.

According to Microsoft, the memory-saving advantage of service hosts has diminished thanks to increased RAM size in modern devices. So, if a PC has 3.5+ GB of RAM installed, svchost won't group services any more. So don't be surprised to see 60+ instances of the svchost process in Task Manager.

The new service model has the following advantages:

1. Increased reliability: If one service crashes, it won't affect other services or the host svchost.exe process. Even if the host svchost.exe process is terminated, other instances and their services will continue to work.
2. Increased Transparency: the user can clearly see system resource usage for each service. You can use the Processes tab or the Details tab to see Memory, CPU, Disk and Network usage per service easily.
3. Reduce servicing costs: Following reports of instability, service engineers, IT admins, and Microsoft engineers can rapidly pinpoint issues related to the exact service and fix it. Now it is easy to find out which service is giving issues and diagnose it.
4. Increase security: Process isolation and individual permission sets for services will increase security.

If your PC has less than 3.5 GB of RAM, the classic service management model will be used. Services will be grouped like in previous versions of Windows.

Service groups are identified at the following Registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

So, when Windows 10 uses service grouping, we will still see a number of instances of Svchost.exe, each running a group of services per instance, but just not as many as when it runs each service in its own svchost.exe process.

That's it.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options: