Windows Forum

Ask something
Discussion Locked

How to identify services

0 helpful
6 replies

by steve.thornburg

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

OS: XP pro
How can I identify processes/services that are shown in task manager or via msconfig?
For example, I see something called "wuauclt.exe" in the task manager "process" pane,with my name shown as the username. And SVCHOST is listed 4 times with usernames of SYSTEM, SYSTEM, NETWORK SERVICE and LOCAL SERVICE.
Looking at msconfig, services, I see something named "Netropa NHK Server" with "unknown" in the Manufacturer column.
What got me started in this is a new computer I purchased for one of my daughters, that constantly tries to connect to the internet. Not more than 3 minutes pass before the dial-up dialog pops up again. So I uninstalled MS Messenger, MS Media Player, Realplayer, all internet access software that came on the machine (AOL, etc), and everything else that I thought might me trying to connect. Still, no luck. I have a very similar machine, same brand, also running XP pro, and it does NOT exhibit this behavior. So, aside from trying to solve that problem, I became curious about service identification. It seems like some security site should maintain a list with associated information.
Any advice/info is greatly appreciated.
Thanks in advance.
Steve

6 replies

by lizzy

In addition to Doug's answer, TR sent out a tip today (XP tech tips) about the svchost services listed and listed a nifty command to identify which one is which:

GAIN RELIABILITY AND BETTER MANAGEMENT WITH SVCHOST.EXE

Many users have noticed what appears to be a weird behavior in Windows XP Professional. The Process tab in Task Manager shows multiple entries for Svchost.exe, which is a generic process that hosts system services running from dynamic-link libraries (DLLs).

There are fourSvchost.exe processes on most Windows XP computers. Why? Microsoft achieves greater reliability by grouping services in more than one Svchost.exe process. Previously, if one service failed or crashed, all services went down with it. Now, only services inside the same Svchost.exe process are affected.

Another reason there are multiple Svchost.exe processes is for security. Different services need different privileges. Grouping services in different processes allows Microsoft to better manage the use of privileged accounts. Within the User name column, two Svchost.exe processes run under the SYSTEM account, one runs under the Network Service account, and another runs under the Local Service account. Once again, the exact number of Svchost.exe entries depends on the individual computer.

To determine which system service runs inside which Svchost.exe process, type tasklist /svc in the command prompt. (doesn't work w\ W2Kpro)

This discussion is closed to new replies.