Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I see svchost.exe having the PID 840, how do I get the information which .exe runs behind the service with cmd.exe on Windows Server 2003? If possible without Sysinternals tools.

share|improve this question
This question doesn't make sense as written. If you see svchost.exe with the PID 840, the .exe is svchost.exe. Do you mean that you want to know which service(s) the process is providing? – Harry Johnston Feb 2 '12 at 2:39
@HarryJohnston Yes, that's what I meant. Maybe that was a bit confusing, but in fact svchost.exe just hosts services which are .exe again, at least they're executable files. – JohnnyFromBF Feb 2 '12 at 9:10
It isn't common to say .exe as a shortcut for executable, unless you actually mean an .exe file. In this case the bulk of the code for each service lives in a DLL file; did you want to know the name of the DLL file(s), or just the name of the service(s)? – Harry Johnston Feb 4 '12 at 4:37
Ok, thanks for the hint. If possible both, the name of the DLL file(s) and the name of the service(s). – JohnnyFromBF Feb 4 '12 at 8:30
I don't know of a specific command line function to retrieve the DLL name, but you can query the registry: reg query HKLM\SYSTEM\CurrentControlSet\Services\{service name}\Parameters /v ServiceDLL – Harry Johnston Feb 4 '12 at 9:01
up vote 5 down vote accepted

On a commandline:

tasklist /svc
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.