Find Svchost Services in Windows Registry

In the Windows Registry, services that run inside shared svchost.exe process groups are defined across two primary registry locations: one that groups the services together and another that defines each individual service’s properties. By navigating these keys using the Registry Editor (regedit.exe), you can view which services belong to specific svchost groups and locate the dynamic-link library (DLL) files that power each service.

1. The Svchost Service Groups Key

Windows maintains a master list of all svchost.exe service groups at the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Inside this key, you will see multiple values (such as netsvcs, LocalService, NetworkService, and secsvcs).

• Value Name: Represents the group parameter passed to the process (for example, svchost.exe -k netsvcs).
• Value Data: A multi-string (REG_MULTI_SZ) listing the short names of all services configured to run within that specific host process group.

2. The Individual Service Definitions

To see the specific configuration for any service listed in an svchost group, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>

Replace <ServiceName> with the actual name of the service found in the Svchost group key.

Within each service’s key, two main values determine its svchost.exe behavior:

• ImagePath: Located directly under the service key, this value contains the execution command, which is set to C:\Windows\System32\svchost.exe -k <GroupName>.
• ServiceDll: Located in the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Parameters, this REG_EXPAND_SZ value specifies the exact path to the .dll file executed by the svchost.exe instance.