LKBEN10729: Which process belongs to a certain systemservice under windows? How to identify the process ID (PID) of a system service.
LKB | Created: 02/04/2020 | Version: 0 | Language: EN | Rating: 0 | Outdated: False | Marked for deletion: False
Author: Wim Peeters - Keskon GmbH & Co. KG
Symptom
Systemprocesses (like Windows Firewall) cannot be identified in Tasklist or Taskmanager
Cause
Some of Windows services run under "svchost.exe"
Solution
Use command TASKLIST in a command shell. Without parameter it delivers a Tasklist similar to the list of processes under Taskmanager (example 1).
While names like cmd.exe or perl.exe are obvious, others need to be known (spoolsv.exe - spooler service, csrss.exe - Client Server Runtime).
For finding the process ID (PID) of a certain service, you might need to know it's original servicename, for instance "SharedAccess" is the servicename for the displayname "Windows Firewall/Shared Internet Access". It can be looked up in the properties of the process in services management Console.
Use TASKLIST /SVC in order to view the services belonging to a (svchost-) process:
...
svchost.exe 924 DcomLaunch, TermService
svchost.exe 992 RpcSs
svchost.exe 1100 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, Themes, TrkWks,
W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe 1156 Dnscache...
and voilà, there they are (above example of Windows Firewall runs as "Shared Access" under PID 1100).
EXAMPLE 1:
F:\>tasklist
Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung
========================= ===== ================ ========== ===============
System Idle Process 0 Console 0 28 K
System 4 Console 0 184 K
smss.exe 592 Console 0 160 K
csrss.exe 640 Console 0 5.228 K
winlogon.exe 664 Console 0 4.904 K
services.exe 708 Console 0 2.288 K
lsass.exe 720 Console 0 1.620 K
Srvany.exe 904 Console 0 180 K
svchost.exe 924 Console 0 2.716 K
svchost.exe 992 Console 0 1.768 K
svchost.exe 1100 Console 0 10.684 K
svchost.exe 1156 Console 0 1.336 K
cmd.exe 1300 Console 0 268 K
perl.exe 1308 Console 0 572 K
svchost.exe 1316 Console 0 2.308 K
spoolsv.exe 1516 Console 0 3.080 K
...
About the Author
Wim Peeters is electronics engineer with an additional master in IT and over 30 years of experience including time spent in support, development, consulting, training and database administration. Wim has worked with SQL Server since version 6.5. He has developed in C/C++, Java and C# on Windows and Linux in different European countries and different European languages. He writes knowledge base articles to solve IT problems and publishes them on the Lubby Knowledge Platform where he is one of the most important contributors and the main developer.