joeware - never stop exploring... :)

Handy blog article for troubleshooting services provided by SVCHOST.

http://blogs.technet.com/ganand/archive/2007/12/23/how-to-isolate-a-service-in-its-own-scvhost-exe.aspx

It also links to

http://support.microsoft.com/kb/314056

Basically the idea is that some service executables have multiple services in them and they share a process when they start. There could be times you don’t want that to happen with SVCHOST because there is such a large number of arbitrary services all bunched together. Running the command

sc config servicename type= own

or changing the Type value in the services registry key to 0x10 will cause that specific service to spin up with its own process. This is good for troubleshooting or isolation and in some cases can fix a “bug” – see http://support.microsoft.com/kb/923416

Warning, there are some services that are written to share data with other services that specifically take advantage of the shared process space and separating them off could break things so when you do this, be careful and make sure you test in a lab first.

Oh if you want to change back, which is not mentioned in the above mentioned blog, either run the command

sc config servicename type= share

or change the Type value in the services registry to 0x20.

For the example given in the blog with BITS, putting BITS in its own process space would look like

sc config BITS type= own

or

reg add hklm\system\currentcontrolset\services\bits /v Type /d 0x10 /f

and to change back

sc config BITS type= share

or

reg add hklm\system\currentcontrolset\services\bits /v Type /d 0x20 /f

    joe