VMware ESXi and vSphere Cluster Management

Using the Services Tab in Process Explorer

Learn how to inspect Windows services hosted by a process in Process Explorer, identify svchost.exe service DLLs, manage service state, and review permissions.

The Services tab in Process Explorer connects a Windows process to the services running inside it. It is especially useful for investigating svchost.exe, because one shared host process can contain several independent Windows services.

Process Explorer is a Windows diagnostic utility for inspecting processes, handles, modules, and related system activity. A Windows service is a background component managed by the Windows Service Control Manager.

When the Services Tab Appears

The Services tab is available in a process's Properties window only when the selected executable is hosting at least one Windows service. A process without a hosted service does not expose this tab.

This distinction matters because not every process associated with a service is the correct process to inspect. Select the executable that actually hosts the service. This may be a dedicated service executable or a shared service-host process such as svchost.exe.

Opening Process Properties

1. In Process Explorer, select the process you want to investigate.
2. Open the process's Properties window, for example by using the process context menu or the corresponding keyboard or menu command.
3. If the executable hosts one or more Windows services, select the Services tab.

The Properties window provides detailed information about the selected process. The Services tab contains the service-to-process association for that particular process, rather than a general list of every service on the computer.

Information Shown for Each Service

The service list normally distinguishes between two names:

• Service name: the internal identifier used by Windows and administrative tools. It is intended for system operations and may be abbreviated or unfamiliar.
• Display name: the descriptive, human-readable label presented to administrators and users.

Each listed entry represents a service hosted by the currently selected process. Comparing the internal service name with its display name helps you map a technical identifier to the Windows feature or capability it represents.

Service DLLs in svchost.exe

svchost.exe is a Windows host process that can run one or more service implementations. Consequently, several service entries may appear under one svchost.exe process.

For a service hosted in this shared process, Process Explorer can show the path of the service DLL. A service DLL is a dynamic-link library that supplies the implementation for a service hosted in a shared service process.

The DLL path is useful when the service name alone does not explain which code is involved. It helps distinguish the implementation associated with a particular service and provides evidence when investigating resource usage, loading problems, or an unexpected service host.

Services Tab Information and Actions

Managing a Selected Service

Select a service in the Services tab to work with its available controls. The available action depends on both the service's supported control operations and its current state.

• Stop: requests that a running service end.
• Restart: stops the service and starts it again.
• Pause: temporarily suspends a service when that operation is supported.
• Resume: continues a service that is currently paused and supports resuming.

A disabled action does not necessarily indicate a Process Explorer problem. The service may not support that control, may already be in a state where the operation is invalid, or may require rights that the current account does not have.

Service Control Availability

Viewing Service Permissions

The Permissions button opens a separate service security dialog for the selected service. This dialog shows access rights assigned to users, groups, and other security principals.

Depending on the assigned rights, a principal may be allowed to query the service, start or stop it, configure it, or perform other management operations. Reviewing these entries can explain why one account can inspect a service while another account cannot control it.

Viewing permissions is different from changing a service's runtime state. The permissions dialog explains authorization; the Stop, Restart, Pause, and Resume controls request changes to the service's operation.

Practical Investigation Examples

Identify a Service Inside a Shared Host Process

1. Select an svchost.exe instance that is consuming resources or is otherwise under investigation.
2. Open its Properties window and select Services.
3. Compare the listed service names and display names.
4. Use the service DLL path to distinguish the implementation associated with a particular hosted service.

This process maps one shared service-host process to the individual services it contains. The result is more precise than attributing every activity of the host to a single, unidentified service.

Restart an Eligible Service

1. Select the process that hosts the affected service.
2. Open Properties, select Services, and select the service entry.
3. Confirm that restart is enabled and consider applications, devices, network connections, and other components that may depend on the service.
4. Initiate the restart, then verify that the service returns to its expected state.

Restart availability depends on the service's capabilities, current status, and the rights of the account performing the operation.

Investigate an Access-Related Management Problem

1. Select the relevant hosted service.
2. Open the permissions view.
3. Review which users or groups have rights to control or configure the service.
4. Use the displayed permissions to determine whether insufficient authorization explains an unavailable or denied administrative action.

A user may be able to view process information and still lack service-control rights. Use an appropriately authorized account only when permitted by organizational policy.

Troubleshooting the Services Tab

The Services Tab Is Absent

The selected process is probably not currently hosting a Windows service. Select the process that actually hosts the service, often a service-host process or a dedicated service executable. Processes without hosted services do not display this tab.

A Service Action Is Disabled

Check the service's current condition, supported operations, and permissions. The service may already be stopped or paused, may not support the requested control, or may require a more privileged account.

The Responsible Service Is Unclear in svchost.exe

Several services can share one svchost.exe process. Use the service list, display names, and implementation DLL paths to isolate the service relevant to the problem.

Stopping a Service Breaks an Application or Feature

The service may provide a required capability or have dependent components. Assess its purpose and dependencies before stopping or restarting it. If the interruption was unintended, restore service operation when appropriate and verify the affected feature.

A User Can View a Service but Cannot Manage It

Process visibility does not automatically grant service-control rights. Inspect the service permissions and determine whether the account has the required access. Follow local security policy when requesting or using an authorized account.

Exam-Relevant Notes

• The Services tab belongs to a process's Properties window, not to every process view.
• It appears only when the selected executable hosts at least one Windows service.
• A service name is an internal identifier; a display name is the human-readable label.
• One svchost.exe process can host multiple services.
• A service DLL path helps identify the implementation loaded for a service in a shared host.
• Stop, restart, pause, and resume depend on service state, supported controls, and permissions.
• Permissions describe who may manage a service; they are separate from changing the service's runtime state.

For a focused reference to this feature, see the Process Explorer Services tab guide.