This blog post explains there exist three known arguments:
-k to run a group of services,
-s to only run a specific service from the specified group, and
-p to turn on process mitigation policies.
Another blog post, provides more details on what
-p does. Windows has an API
SetProcessMitigationPolicy which a process can use to enable various mitigations against security vulnerabilities. Each possible type of mitigation is known as a "policy". In the Windows registry, under
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost, there are three values which can be created to toggle three particular policies for
-p option does, is force those three security mitigation policies to be turned on for this
svchost.exe process, even if they are not enabled in the registry.
Why does this option exist? Well, the ideal from a security viewpoint would be to toggle all three policies on in the Windows registry, so they are on all the time. However, it is possible that there is some product out there (whether Microsoft or third-party) which contains a service running in
svchost.exe and which breaks with these flags being turned on, hence Microsoft doesn't want to turn them on by default. However, for services shipped with Windows, where Microsoft knows they work fine with these flags turned on, there would be better security by having these flags turned on for those particular services. Hence
-p can turn those flags on for a particular group of services without turning them on for all
Of course these are undocumented internals of Windows, and there is always the chance that Microsoft might break them in some future version. One should be aware of that possibility before trying to rely on them for anything.