Windows 中大量的 svchost.exe 進程是什麼？

12-30

這就像chrome有很多個進程，但是實際上若干個網頁共享同一個進程一樣。svchost也是用來跑幾百個windows service的。如果一個service就用一個svchost，那就真的是大量了。

svchost 是服務宿主進程。

眾所周知，WINDOWS 運行時有許多個服務需要保持運行來提供特定功能，這些服務可以用單獨進程，也可以寄宿在SVCHOST上。Windows 設計是可以做到多個服務共享一個宿主進程，而且這也是默認行為。

然而，在Win10創造者更新之後增加了個特殊行為：發現機器內存大於一定數值則啟用獨立宿主功能。這就使得每個服務都有一個單獨的SVCHOST 。這可能就是你看到非同尋常多SVCHOST 的原因。這個值是3.5G，關於這個改動的詳情在這裡可以看到：Announcing Windows 10 Insider Preview Build 14942 for PC

摘抄相關段落：

Service hosts are split into separate processes on PCs with 3.5 GB+ of RAM: If your PC has 3.5+ GB of memory, you may notice an increased number of processes in Task Manager. While this change may look concerning at first glance, many will be excited to find out the motivation behind this change. As the number of preinstalled services grew, they began to get grouped into processes known as service hosts (svchost.exe』s) with Windows 2000. Note that the recommended RAM for PC』s for this release was 256 MB, while the minimum RAM was 64MB. Because of the dramatic increase in available memory over the years, the memory-saving advantage of service hosts has diminished. Accordingly, ungrouping services on memory-rich (3.5+ GB of RAM) PCs running Windows now offers us the opportunity to do the following:

Increase reliability: When one service in a service host fails, all services in the service host fail. In other words, the service host process is terminated resulting in termination of all running services within that process. Individual service failure actions are then run. As you may have noticed in Task Manager before, service hosts can contain a lot of services:

Increase transparency: Task Manager will now give you a better view into what is going on behind the scenes. You can now see how much CPU, Memory, Disk Network individual services are consuming.

To see the name of the service, click on the left-most arrow such that the Display name drops down. Alternatively, right-click on the header and select 『Command Line』 to add the Command Line column. Service names will be listed in the format 『svchost.exe -k & -s &.』

Reduce servicing costs: Following reports of instability, service engineers, IT admins, and Microsoft engineers can rapidly pinpoint issues to the exact service and fix it.
Increase security: Process isolation and individual permission sets for services will increase security.

Note that critical system services (services whose recovery require system restarts), as well as a couple of select service hosts, will remain grouped.

正常。

提高知乎討論環境，規範提問，杜絕錯別字，杜絕錯誤標點符號，拒絕亂加標籤，從我做起。

題主你提問完能不能回來看看，你寫的這是個啥？

一驚一乍大驚小怪

跑服務的host叫service host，簡稱svchost

Win7的svchost.exe一般還是很多個服務共享一個進程，這樣可以節省系統資源。

Win10 1703開始，內存夠大時就不會這麼幹了，都拆成獨立的一個個svchost.exe進程。

還有，服務未必是Windows自己的，各種第三方軟體甚至木馬病毒也可以註冊服務，甚至也可以用svchost，對惡意軟體來說，用svchost更掩人耳目。

每個svchost對應不同的命令行，為windows完成不同的功能。比如區域網服務啊，印表機服務啊，音頻服務啊等等。

可能你關了印表機服務感覺沒什麼，你關了另一個服務就發現系統關機了。

通過第三方軟體(或者win10自帶的任務管理器)可以看到對應每個進程分別是什麼命令什麼服務

不過十分不建議手動結束任何svchost進程