What is svchost.exe and why does it use so many ports?

Open Task Manager on any Windows 10 or 11 PC and you will find dozens of processes called svchost.exe. Run netstat -ano and a good share of the listening ports belong to them. Neither is a sign of trouble. This guide explains what the process is, why there are so many copies, which services are behind the ports you see most often, and how to check that a given copy is the real thing.

What svchost.exe is

Many Windows services are not standalone programs. They are DLLs that export a service entry point, and a DLL cannot run on its own. svchost.exe, the Service Host, is the generic executable that loads one or more of those DLLs and runs them as services under the Service Control Manager, services.exe. The DLL for each service is recorded in the registry. For the DNS Client:

(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters').ServiceDll

%SystemRoot%\System32\dnsrslvr.dll

Each copy of svchost.exe is started with a command line that names its group and, usually, the single service it hosts:

C:\Windows\System32\svchost.exe -k NetworkService -p -s Dnscache

-k names the service group, -s names the service, and -p turns on stricter process mitigation policies for that host.

Service groups and why there are so many copies

Services are assigned to groups such as netsvcs, LocalService, NetworkService, LocalServiceNetworkRestricted, DcomLaunch and RPCSS. The group decides which account the host runs as (SYSTEM, LOCAL SERVICE or NETWORK SERVICE) and what privileges and network access it gets. The group definitions live under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost.

Until Windows 10 version 1703, every service in a group shared one svchost.exe, so a PC ran perhaps a dozen copies, each holding many services. Since then, on machines with more than 3.5 GB of RAM, Windows starts most services in a host of their own. A crashing or leaking service takes down only itself, Task Manager can show which service is using the CPU, and each host gets only the privileges its service needs. The cost is sixty to ninety svchost.exe entries in Task Manager, which is normal. A few services still share a host because they must; RpcSs and RpcEptMapper in the RPCSS group are the best-known pair.

Why svchost owns so many ports

A service that talks to the network needs a socket, and a socket belongs to the process that created it, which is the host. The ports you will meet most often:

Which rows appear on your PC depends on what is enabled. Turn off network discovery and the SSDP and WS-Discovery listeners typically disappear; enable Remote Desktop and 3389 appears.

One port trips people up: 5985, WinRM. The WinRM service does run inside svchost.exe, but it does not open the socket itself. It registers a URL with the kernel HTTP driver, HTTP.sys, and the listener on 5985 shows up under PID 4, System. IIS and Windows Admin Center work the same way. When the owner is PID 4, netsh http show servicestate lists which processes have registered which URLs.

See which services a svchost hosts

Given a PID from netstat -ano or Get-NetTCPConnection, the command-line route is tasklist /svc, which lists services next to every process:

tasklist /svc /FI "PID eq 1116"

Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1116 RpcEptMapper, RpcSs

PowerShell adds display names, state and start mode:

Get-CimInstance Win32_Service | Where-Object ProcessId -eq 1116 |
  Select-Object Name, DisplayName, State, StartMode

The reverse direction, from a service to its PID, is sc queryex:

sc queryex Dnscache

The PID line in its output is the host process. In Task Manager, the Services tab shows the PID next to each service, and the Details tab can show the full command line (right-click a column header, choose Select columns, tick Command line), which is the quickest way to read the -k group and -s service of every host at once. Resource Monitor’s Listening Ports list shows the same thing per port, with the service group in parentheses after the image name.

Whichever tool you use, a host that carries several services reports all of them. Windows does not record which of two services inside one process opened a particular socket. With today’s one-service-per-host layout this is rarely a problem, and for RPCSS the honest answer is both.

Genuine or impostor?

Because the name is so familiar, malware sometimes borrows it. The check is short and needs no extra tools. It is a check, not a verdict, so weigh the whole picture rather than one item.

A genuine svchost.exe:

• runs from C:\Windows\System32\svchost.exe, or C:\Windows\SysWOW64\svchost.exe for 32-bit hosts, and never from C:\Windows itself, a user profile, Temp or Program Files;
• is spelled exactly svchost.exe, not svch0st.exe, scvhost.exe or svchost32.exe;
• has services.exe as its parent process;
• carries -k <group> on its command line;
• runs as SYSTEM, LOCAL SERVICE or NETWORK SERVICE, not as your user account;
• has a valid Microsoft Windows signature.

Path, parent and command line come from one query:

Get-CimInstance Win32_Process -Filter "ProcessId = 1116" |
  Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine

Then confirm the parent and the signature, substituting the parent PID from the previous output:

Get-Process -Id 912 | Select-Object ProcessName
Get-AuthenticodeSignature C:\Windows\System32\svchost.exe |
  Select-Object Status, @{ n = 'Signer'; e = { $_.SignerCertificate.Subject } }

The parent should be services, Status should be Valid, and the signer subject should start with CN=Microsoft Windows. Windows system files are usually signed through a security catalog rather than a signature embedded in the file; on Windows 10 and 11 PowerShell checks the catalog for you.

A process that fails one of these points deserves a closer look: Task Manager’s Open file location and a scan with Windows Security are the next steps. A process that passes all of them is Windows doing its job.

Should you stop it?

Ending svchost.exe from Task Manager stops every service inside it, and the Service Control Manager may restart it or let dependent features fail quietly. If a service’s port bothers you, act on the service, not the host.

Warning

These commands change Windows services and need an elevated PowerShell. Stop-Service lasts until the next restart; Set-Service -StartupType Disabled is permanent until you change it back, and features that depend on the service stop working. Note the current startup type first with Get-Service -Name SSDPSRV | Select-Object Name, Status, StartType so you can restore it.

Stop-Service -Name SSDPSRV
Set-Service -Name SSDPSRV -StartupType Disabled

The Settings app exposes some of these as ordinary switches (Network discovery, Delivery Optimization), which is the better place to start. Only disable a service when you know what depends on it:

Get-Service -Name SSDPSRV -DependentServices

How PortWho shows it

The manual route is port, PID, tasklist /svc, then a signature check. PortWho, Utility Forge’s port inspector, folds those steps into one row per socket: protocol, address, port, PID, process name, executable path, the hosted services and the Authenticode status with the signer. For a service-host port that means portwho 135 names RpcEptMapper and RpcSs next to the PID and says who signed the executable, and portwho --search Dnscache finds every socket of the DNS Client, because the search matches service names and signers as well as process names. portwho --json returns the same facts for scripts. This is the documented shape for a port 135 endpoint, trimmed from the JSON output reference:

{
  "protocol": "tcp",
  "addressFamily": "ipv4",
  "localAddress": "0.0.0.0",
  "localPort": 135,
  "processId": 1116,
  "process": {
    "status": "resolved",
    "name": "svchost",
    "executablePath": "C:\\Windows\\System32\\svchost.exe",
    "services": [
      { "name": "RpcEptMapper", "displayName": "RPC Endpoint Mapper" },
      { "name": "RpcSs", "displayName": "Remote Procedure Call (RPC)" }
    ],
    "signature": {
      "status": "signed",
      "signer": "Microsoft Windows",
      "organization": "Microsoft Corporation",
      "issuer": "Microsoft Windows Production PCA 2011"
    }
  }
}

Because most Windows binaries are catalog-signed, expect many system rows to report the status catalogSigned, with the catalog’s signer shown. PortWho is read-only: it never stops a process or service and never uses the network, including for signature checks. It is currently in development: the engine, the command line and a desktop application are implemented and tested internally, and there is no public download yet. The PortWho page tracks its status, and if the port you are chasing is a developer port rather than a service, start with Find what is using port 8080 on Windows.