WINDOWS SERVICE

swprv: Microsoft Software Shadow Copy Provider

Q: How do I see the shadow copy providers on my PC?

Microsoft documents vssadmin list providers: it lists the volume shadow copy providers registered on the computer, among them the built-in system provider that Windows includes. Run it from a Command Prompt opened as administrator.

Q: How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k swprv, a service group of its own, runs as LocalSystem and loads C:\Windows\System32\swprv.dll, signed by Microsoft Windows. It depends on RpcSs.

Manages software-based volume shadow copies taken by the Volume Shadow Copy service.

TECHNICAL SUMMARY

Service name	swprv
Display name	Microsoft Software Shadow Copy Provider
Runs from	C:\Windows\System32\svchost.exe
Command line	svchost.exe -k swprv
Runs as	LocalSystem
Verdict	Leave it alone
Microsoft, Windows Server 2016 guidance	No guidance

Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.

Should you touch it?

Leave it alone

Microsoft states that if it is stopped, software-based volume shadow copies cannot be managed, and that services which explicitly depend on it cannot start if it is disabled. Its guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices rates it OK to disable. Its default startup type is Manual, so it costs nothing while idle: on the PC used for this page it was stopped.

What PC Tweaker does with it

PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.

Check it yourself

See its state and start type

Get-Service swprv | Format-List Name, DisplayName, Status, StartType
sc qc swprv

PowerShell

Common questions

What does the swprv service do?

Manages software-based volume shadow copies taken by the Volume Shadow Copy service. It runs C:\Windows\System32\svchost.exe (svchost.exe -k swprv) as LocalSystem.

Can I disable swprv?

Leave it alone. Microsoft states that if it is stopped, software-based volume shadow copies cannot be managed, and that services which explicitly depend on it cannot start if it is disabled. Its guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices rates it OK to disable. Its default startup type is Manual, so it costs nothing while idle: on the PC used for this page it was stopped.

How do I see the shadow copy providers on my PC?

Microsoft documents vssadmin list providers: it lists the volume shadow copy providers registered on the computer, among them the built-in system provider that Windows includes. Run it from a Command Prompt opened as administrator.

How do I check that it is the real service?

On Windows 11 build 26300 it is registered as svchost.exe -k swprv, a service group of its own, runs as LocalSystem and loads C:\Windows\System32\swprv.dll, signed by Microsoft Windows. It depends on RpcSs.