Q. How can I view active Svchost-instance services in Windows Server 2008 or Windows Vista?

A. Run the Server 2008 or Vista built-in Tasklist command with the /svc switch to view the services running in each Svchost instance, as the following example demonstrates. You'll notice that a list of services is shown for each Svchost instance.

You would enter

UsersAdministrator.SAVTSTDC01>tasklist /svc

The output would be:

Image Name            PID Services==============

============================================System Idle Process   0 N/ASystem                4 N/Asmss.exe              500 N/Acsrss.exe             568 N/Awininit.exe           620 N/Acsrss.exe             632 N/Aservices.exe          672 N/Awinlogon.exe          704 N/Alsass.exe             720 KeyIso, ProtectedStorage, SamSslsm.exe               728 N/Asvchost.exe           896 DcomLaunch, PlugPlaysvchost.exe           956 RpcSssvchost.exe           996 WinDefendsvchost.exe           424 AudioSrv, Dhcp, EventLog, lmhostssvchost.exe           540 gpsvcsvchost.exe           548 AeLookupSvc, Appinfo, BITS, CertPropSvc,                          EapHost, IKEEXT, iphlpsvc, LanmanServer,                          MMCSS, ProfSvc, RasMan, Schedule, seclogon,                          SENS, SessionEnv, ShellHWDectection, Themes,                          Winmgmt, wuauservSLsvc.exe             12 slsvdsvchost.exe         1028 EventSystem, FDResPub, LanmanWorkstation,                          netprofm, nsi, SCardSvr, SstpSvc, W32Timesvchost.exe          1088 AudioEndpointBuilder, hidserv, Netman,                          UmRdpService, UxSms, WdiSystemHost,                          WPDBusEnum, wudfsvcsvchost.exe          1112 TabletInputServicesvchost.exe          1176 CryptSvc, Dnscache, KtmRm, NlaSvc,                          TermService, WinRMsvchost.exe          1272 Wlansvcaudiolog.exe         1388 N/Asvchost.exe          1424 BFE, DPS, MpsSvcsvchost.exe          1488 WebClienttaskeng.exe          1600 N/Aspoolsv.exe          1728 Spooler