Q: How can I make a service that normally runs in a shared SVCHOST instance run in its own SVCHOST instance?

A: Several services share SVCHOST instances. You can see this if you run

tasklist /svc

as shown below. Or you can right-click a SVCHOST process in Task Manager and select Go to Service(s).

svchost.exe                    324 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
svchost.exe                    488 AudioEndpointBuilder, CscService, hidserv,
                                   Netman, PcaSvc, TabletInputService, TrkWks,
                                   UxSms, WPDBusEnum, wudfsvc
svchost.exe                    540 BITS, Browser, CertPropSvc, EapHost, gpsvc,
                                   hkmsvc, IKEEXT, iphlpsvc, LanmanServer,
                                   MMCSS, ProfSvc, RasMan, Schedule, SENS,
                                   ShellHWDetection, Themes, Winmgmt, wuauserv
winlogon.exe                  1052 N/A
svchost.exe                   1212 EventSystem, netprofm, nsi, SstpSvc,
                                   W32Time, WdiServiceHost
Pen_TouchService.exe          1308 TouchServicePen
svchost.exe                   1456 CryptSvc, Dnscache, LanmanWorkstation,
                                   napagent, NlaSvc, TapiSrv
spoolsv.exe                   1608 Spooler
svchost.exe                   1644 FontCache, SCardSvr, SSDPSRV, upnphost
svchost.exe                   1676 BFE, DPS, MpsSvc

There might be times when, for troubleshooting or compatibility, you want to stop a service from sharing a SVCHOST instance. The SVCHOST groups are defined at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost in the registry. You can create a new SVCHOST group in the registry with the name of the service and remove the service from the existing SVCHOST group.

You can also tell a service to run in its own process without having to create a new SVCHOST group. Navigate to the service's registry location, such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Themes. Change the Type from decimal 32 to decimal 16. Once the system reboots, the service will run in its own SVCHOST processm as shown below. Note that Themes is now in its own SVCHOST process.

svchost.exe                    988 AudioSrv, Dhcp, eventlog, lmhosts
svchost.exe                    372 AudioEndpointBuilder, CscService, PcaSvc,
                                   SysMain, TrkWks, UmRdpService, UxSms,
                                   WdiSystemHost, WPDBusEnum
svchost.exe                    444 Appinfo, BITS, Browser, CertPropSvc,
                                   iphlpsvc, LanmanServer, MMCSS, ProfSvc,
                                   Schedule, SENS, SessionEnv,
                                   ShellHWDetection, Winmgmt
svchost.exe                    912 gpsvc
svchost.exe                    744 Themes
svchost.exe                   1048 EventSystem, netprofm, nsi, W32Time,
                                   WdiServiceHost, WinHttpAutoProxySvc
svchost.exe                   1176 CryptSvc, Dnscache, LanmanWorkstation,
                                   NlaSvc, TermService
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish