Task Manager - Network Service

[Alex]

Dear colleagues,

how can I determine who (which computer or IP) is running a service on my
computer.

E.g. WMIPRVSE.EXE is running LOCAL but also there is an service running as
NETWORK SERVICE. I know that this service is triggered by an extrnal
computer (inventory software). As well SVCHOST.exe seems to be initiated by
an external program on a other computer.

I am simply interessted who is making my computer so slow and who tries to
collect / connect to my computer with which service.

Thanks Alex

 

[Guest]

I'd suggest using Process Explorer (free here:
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx )

But the items you mention may not be external to your system - they are
usually internally launched and are able to monitor/do things on the network.
For example, my system also shows wmiprsve.exe as a Network service and I'm
not connected to anything else other than the default services (it's in a VM).

Here's a link about it:
http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

I've got 2 svchost.exe running as Network Services - one has the DNSCache
running under it and the other has the RPCSS running under it.

- John

 

[Newbie Coder]

Alex,

I suggest using the Process Explorer from Microsoft Technet & the username
is at the base of the IMAGE tab when you double-click a process.

http://download.sysinternals.com/Files/ProcessExplorer.zip

 

[Alex]

Dear all,

Thanks a lot for the hint. I already use this tool but it's still dificult
to find out who is accessing my computer. There must be a tool in
combination with firewall and prossess task management SW. Any other ideas?

Thanks, Alex

 

[Wesley Vogel]

NetworkService loads DnsCache, the DNS Client service.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\SvcHost
Value Name: NetworkService
Data Type: REG_MULTI_SZ
Value Data: DnsCache

%SystemRoot%\system32\svchost.exe -k NetworkService

The NetworkService account is a predefined local account. It has minimum
privileges on the local computer and acts as the computer on the network.
The name of the account is NT AUTHORITY\NetworkService.

tasklist /svc in a command prompt will show which svchost.exe listed in the
Task Manager is loading the service.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In