A. Run the Server 2008 or Vista built-in Tasklist command with the /svc switch to view the services running in each Svchost instance, as the following example demonstrates. You'll notice that a list of services is shown for each Svchost instance.
You would enter
Users\Administrator.SAVTSTDC01>tasklist /svc
The output would be:
Image Name PID Services
==============
============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 500 N/A
csrss.exe 568 N/A
wininit.exe 620 N/A
csrss.exe 632 N/A
services.exe 672 N/A
winlogon.exe 704 N/A
lsass.exe 720 KeyIso, ProtectedStorage, SamSs
lsm.exe 728 N/A
svchost.exe 896 DcomLaunch, PlugPlay
svchost.exe 956 RpcSs
svchost.exe 996 WinDefend
svchost.exe 424 AudioSrv, Dhcp, EventLog, lmhosts
svchost.exe 540 gpsvc
svchost.exe 548 AeLookupSvc, Appinfo, BITS, CertPropSvc,
EapHost, IKEEXT, iphlpsvc, LanmanServer,
MMCSS, ProfSvc, RasMan, Schedule, seclogon,
SENS, SessionEnv, ShellHWDectection, Themes,
Winmgmt, wuauserv
SLsvc.exe 12 slsvd
svchost.exe 1028 EventSystem, FDResPub, LanmanWorkstation,
netprofm, nsi, SCardSvr, SstpSvc, W32Time
svchost.exe 1088 AudioEndpointBuilder, hidserv, Netman,
UmRdpService, UxSms, WdiSystemHost,
WPDBusEnum, wudfsvc
svchost.exe 1112 TabletInputService
svchost.exe 1176 CryptSvc, Dnscache, KtmRm, NlaSvc,
TermService, WinRM
svchost.exe 1272 Wlansvc
audiolog.exe 1388 N/A
svchost.exe 1424 BFE, DPS, MpsSvc
svchost.exe 1488 WebClient
taskeng.exe 1600 N/A
spoolsv.exe 1728 Spooler