Huddled Masses

I’ve finally figured out how to tell windows which services to run together in one service host, and which I want in their own host, it’s tricky, but first, let me explain why I wanted to do this…

This last week or so, I’ve been having problems with a runaway svchost.exe process on several of my computers. I’ve theorized that it’s due to Windows™ Update, but I haven’t been able to prove it one way or another, because when I went to find out what was in that process, it went something like this:

1. I went to Windows Task Manager (by pressing Shift+Ctrl+Esc) and in the processes tab, I saw that the reason my PC was running slowly was that I had a svchost.exe process using more than 80% of my CPU, and over 200MB of RAM (that’s at home, at work I have susbtantially less RAM, so it was around 120MB when I noticed my PC slowing to a crawl).
2. I tried to detect what service was the problem by going to the command line (Start->Run: cmd.exe) and typing Tasklist /svc but what I discovered is that the runaway service host was actually hosting 25 different services … which one could it be?
3. I ran ProcessExplorer and found basically the same information, along with a listing of the “friendly” names of the services …
4. I ran my services manager console (Start->Run: services.msc), and using the friendly names from Process Explorer, I tried stopping the services one at a time, but the memory was never released (although the CPU usage did go down after I stopped the Automatic Updates service).

1. I killed the svchost.exe process (from the process tab of the Task Manager) and my memory was released, but now my internet didn’t work properly, my scheduled tasks were disabled and in general, I couldn’t really use the PC, because I’d just killed off 2/3 of my processes.

It was at this point that I suddenly started wondering why there’s not a way to just separate these services into their own processes so that I could narrow down the problematic service … and I did some searching, and some experimenting, and it turns out there is a way.

To separate a service into a new svchost

[new] The automatic way:

Upon suggestion from Karanjit Sidhu below I checked out sc.exe … it’s a command-line app for communicating with the Windows Service Control Manager and individual services, and the config option that he mentioned basically lets you do this a completely different way that I didn’t know about

Setting the service’s type to “own” instead of “shared” causes it to run in it’s own process even while it remains in the same named group. That is, instead of creating a new subkey in the “svchost” key as I suggested below, it simply changes that service’s Type value in HKLM/SYSTEM/CurrentControlSet/Services/@name@ to 16 instead of 32, causing the service to run in it’s own host process. Not only is this a much simpler change, registry-wise, you don’t have to do it manually in the registry, you can just run: sc.exe config [servicename] <option1> .... in fact, you should run sc.exe config by itself to see the help, because it enumerates the options for type, and also lets you set services to start delayed, etc or change their group (which is what I did below).

After you make this change, you have to stop and start the service to get it to run in it’s own host process — you can do that from the command-line using sc.exe stop [servicename] and sc.exe start [servicename]

The (original) manual way:

I’m leaving this here for the record — it’s the process I originally suggested, and it does work, but the “automatic” way listed above is much easier

The first thing you should know is that I’ve only been running with these changes in place for about one day, so there may be problems hiding under the hood that I haven’t detected. As always, when editing the registry, please make backup copies, and be aware that my tech-support rates are $40 an hour if you mess something up and need my help You may refer to KB 314056 if you think it will help.

We’ll be working in two keys in the registry:

• HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost

• HKLM/SYSTEM/CurrentControlSet/Services

I’ll be referring to the first as the “SvcHost” key, and the second as the “Services” key, so please follow carefully:

1. Go to the SvcHost key, and notice the list of REG_MULTI_SZ values. Each one is a seperate service host, and consists of a list of the services (one per line) that will be hosted by that host. As far as I know, the names are completely arbitrary.
2. Find the host you want to take something out of… in my case it was “netsvcs”
3. Check: is there a subkey with that name? If there is:
   1. Make an exact duplicate of that subkey, but with a different name (why? because I don’t know what these are for, and when you don’t know what you’re doing, the best bet is to copy someone who does). I named mine “netsvcs2” so that I could easily tell where it came from.
1. Make sure you copy all the values inside it (there’s probably just two REG_DWORD values), make sure they are set the same as the originals.
4. Make a new REG_MULTI_SZ in the SvcHost key with the new name (the same name you used for the subkey, if you made one above).
5. Edit the original host’s value to remove the service name(s) a??in my case, just one: wuauserva?? without leaving any blank lines …
6. Edit the new host’s value to add the service name(s) a??Your best bet is to cut it from one and paste it in the other.
7. Now go to the Services key
8. For each service that you moved, you need to find their subkey
9. Edit the “ImagePath” value:
   1. It probably starts with something like: svchost.exe -k netsvcs
   2. You should only edit the part after the -k

1. You have to use the exact name you gave your new host in the steps above (mine says svchost.exe -k netsvc2

That’s it. You’re done. You may now reboot, or simply stop and restart that service (or those services, if you moved more than one) and it should run in it’s own host from now on. I’m still waiting for my runaway service to run away again, so I can verify that it’s the Windows™ update one, but if it is, I think I’m going to call Microsoft’s tech support for the first time in my life.

16 Responses to “Separating SvcHost Services”