Break-out the low-level processes running under SVCHOST

This is an after thought note the preceding post.

Windows uses the Service Host (svchost.exe) process to collect a number of lower-level critical system services into a single process instance for task management. It does this to reduce boot time, system overhead and reduce the number of separate lower-level service processes running.

Windows creates different svchost.exe instances based on the different lower-level processes' system access and security requirements.

To determine which processes are running under a single svchost.exe instance use the following command sequence from the command-line:

tasklist /svc /fi “imagename eq svchost.exe”

Make sure to type it from scratch, sometimes copying and pasting will cause the command parser to misinterpret the section in quotations on this particular command.

It should output something that looks like the following:

Check out this link for a deeper look at TechNet details on the tasklist command:

http://technet.microsoft.com/en-us/library/cc730909(WS.10).aspx

Bad service!! BAD! STOP!!

Have you ever tried to stop or restart a Windows Server service when you couldn't afford to reboot because the CFO was in the middle of something "Financial" on the server and you like having a job? Well I have and on many occasions. Now what happens when that service doesn't want to stop?

SMTP service "stopping".... (get lunch and come back) SMTP service "stopping"....

Ugh.

Well if that service is an executable file then you can force it to stop with either the following command sequences:

taskkill /s hostname /IM ImageName /F

taskkill /PID ProcessID /F

But you say, "That's great, ServerGoBoom, but how do I figure out the ImageName or ProcessID for the &#^$%! service I want to kill .. er ... stop?"

Good question. You could do it one of a couple ways both involving the Windows Task Management systems, graphical and textual. :)

You can use Task Manager which provides a GUI view of the Process currently running on your system. If you don't already know, you can access this utility easily by right-clicking the Task bar (or Start Bar) and choosing Task Manager from the dropdown menu that appears.

Once you have it open, you'll notice that the Task Manager window has several tabs, one of which is Processes. Click this to put it in focus. If you don't see a column named PID then click the View option at the top of the window, click Select Columns ... then put a check in the box next to PID (Process Identifier) and click OK.



Now you can see which Services (Image Name column) match which PIDs (PID Column), plug in the info for the service that won't stop into the either of the command sequences quoted above and bingo. Bob's your uncle, Fanny's your aunt. Service stopped.

If you prefer the simplicity and stark beauty of the command-line as I do, then you can open the command prompt and use the tasklist command to generate a text-based table of the same info that looks like this:









Check out this link for the TechNet break-down on the Taskkill command:


http://technet.microsoft.com/en-us/library/cc725602(WS.10).aspx