Isolate hosted service (svchost.exe) in its own process

Question

As many superusers are probably aware by now, svchost.exe is used by Microsoft to host multiple Windows services in a single process, with one process per service group.

In Windows 7 (and later?), one can right click on a specific svchost.exe process in Task Manager and select "Go to service(s)" to see the services running "inside" it. Across all Windows versions, Process Explorer can also be used.

However, this does not allow one to see e.g. which particular service is pinning the CPU at 100%, or using 700 MB of memory. One can manually stop services in the same group and use the process of elimination, but it's tedious, especially if the problem occurs only intermittently.

Microsoft presumably has a good reason to group services like this (reducing the per-process overhead, perhaps?), but is there a way to force a specific service to run isolated in its own svchost.exe?

Answer 1

No, the proper way is to run this command:

sc configwuauserv type= own

this configures to run Windows Update in its own process. To revert this, run

sc config wuauserv type= share

from a command prompt with admin rights. This changes the setting value type. If type is 0x20 it is a group process, if the value is 0x10 it is a own process.

Since Windows 10 Creators Update (Version 1703, Build 15063), Windows does this on its own if you have enough RAM.

Answer 2

Only way I know is via registry hacking. The usual registry database editing disclaimer applies (it may destroy anything from your Windows install to the entire fabric of spacetime).

The following example isolates the Windows Update (wuauserv) service, which is known to misbehave and use excessive resources. The method has been tested only on Windows 7.

1. Start regedit.exe (Registry Editor), and navigate to

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
   

   This key contains a subkey for each group containing group settings, as well as a REG_MULTI_SZ value for each group listing the services in the group.

2. Look in the subkey for the current group of the target service (in this example: netsvcs), then create a new subkey with a suitable name and identical contents. Remember to observe the value types, as well as contents.

3. Create a REG_MULTI_SZ value named after the new group, containing a only single line with the service name; and remove the service name from its existing group REG_MULTI_SZ.

4. Next, navigate to the target service subkey beneath HKLM\SYSTEM\CurrentControlSet\services. In this example:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv
   

5. Edit the ImagePath value, and change the group name after -k to the new group name.

6. Restart the target service (e.g. using the Services tab in Task Manager, or via services.msc), and it should appear in it's own separate svchost.exe process.

Next time Windows Update runs amok, its resource use is immediately visible in Task Manager, and it can even be killed using "End Process" (not recommended for more critical services, though).

If the service fails to start, review the steps above and try again, or try reverting your changes, while recalling the warning at the top. :-)