What determines which services svchost.exe hosts?

Question

When viewing processes under Process Explorer, there is services.exe, which has several svchost.exe subprocesses. Each of these hosts one or more services. However, selection of services in single process seems completely random.

How does the process select which services it hosts? Can this be affected somehow?

I can't find any controls for this in services.msc.

I would want to force some services into their own processes, separate from others.

Answer 1

There is a database in the Registry to control how services are loaded. This is the Service Control Manager database.

The Service Control Manager runs services.exe. Services are defined in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The Type value of the service's entry specifies if it is loaded in its own process or in a process that hosts multiple services.

When the SCM decides to start a service, it calls ScStartService. ScStartService determines the name of the file that runs the service's process by reading the ImagePath value from the service's Registry key. The ImagePath value also contains the name of the group. It then examines the Type value. A value of 0x20 indicates a shared process.

To answer your question about how to make a service run in its own process, use the sc config command.

Example: sc config wuauserv type= own The space after = is required.

Technet

Source

Answer 2

You won't find controls in services.msc, but each service will be started under a particular user/service account which has particular rights depending on the requirements of the service.

The column "Log On As" in the services control panel will show you what service account is used for particular services. You'll note that each svchost.exe in task manager appears to be from a different user account.

It is these accounts that will determine which svchost.exe is hosting each service.

---

Technically there are controls to change what svchost.exe is hosting a particular service as you can change the user that the service logs on as in the "Log On" tab of the service properties. I would not advise changing them though as you could end up with services starting up in the wrong order or without the rights that they require.