Win7/8 Split svchost Option

Comments

• nuhi

  June 2017 edited June 2017

  
  Hi e_web,
  
  interesting topic, was saving it for later, so pardon the delay.
  
  Are you using the word "Split" for "Grouping"?
  
  That said, I'm a bit confused as to what was the goal, group them as shown in Task Manager (attached) or, what's the benefit? Don't understand that 4GB limit and crashing, are you saying it all crashes svchost normally when one service under Win7 is crashed?
  
  Sorry if my wisdom is not as expected
  Thanks!
• e_web

  June 2017 edited June 2017

  In the new Windows 10 Creators update they broke off the shared .dlls inside the svchost.exe so that each now runs in its own instance so that if for some reason one .dll/instance crashes the entire 'group' doesn't. Thus I used the word 'split' as I wanted to break them up on Win7 myself for the same reason. I was able to do so and created a .bat that I ran as SYSTEM via RunasTI.
  
  I've attached a zipped .bat I made to work on both 7/8 to apply this change in a VM before sysprep but so far as NTLite would be concerned [if you wanted to add this] you'd just want to scan the ControlSet1\services\ for svchost.exe -k in the ImagePath or something and change the Type dword from 0x20 to 0x10
  
  So far [I haven't been able to test everything] just RpcEptMapper and RpcSs need to be kept grouped for stability then there was WdiSystemHost and UxSms for proper Aero functionality.
  
  https://blogs.windows.com/windowsexperience/2016/10/07/announcing-windows-10-insider-preview-build-14942-for-pc/

  Service hosts are split into separate processes on PCs with 3.5 GB+ of RAM: If your PC has 3.5+ GB of memory, you may notice an increased number of processes in Task Manager. While this change may look concerning at first glance, many will be excited to find out the motivation behind this change. As the number of preinstalled services grew, they began to get grouped into processes known as service hosts (svchost.exe’s) with Windows 2000. Note that the recommended RAM for PC’s for this release was 256 MB, while the minimum RAM was 64MB. Because of the dramatic increase in available memory over the years, the memory-saving advantage of service hosts has diminished. Accordingly, ungrouping services on memory-rich (3.5+ GB of RAM) PCs running Windows now offers us the opportunity to do the following:
  
  Increase reliability: When one service in a service host fails, all services in the service host fail. In other words, the service host process is terminated resulting in termination of all running services within that process. Individual service failure actions are then run. As you may have noticed in Task Manager before, service hosts can contain a lot of services:
  services_1
  Increase transparency: Task Manager will now give you a better view into what is going on behind the scenes. You can now see how much CPU, Memory, Disk & Network individual services are consuming.
  services_2
  To see the name of the service, click on the left-most arrow such that the Display name drops down. Alternatively, right-click on the header and select ‘Command Line’ to add the Command Line column. Service names will be listed in the format ‘svchost.exe -k -s .’
  Reduce servicing costs: Following reports of instability, service engineers, IT admins, and Microsoft engineers can rapidly pinpoint issues to the exact service and fix it.
  Increase security: Process isolation and individual permission sets for services will increase security.
  
  Note that critical system services (services whose recovery require system restarts), as well as a couple of select service hosts, will remain grouped.

  Update:
  Looking at a Win10 CU install I noticed that both BFE & MpsSvc were kept as shared [together, though it uses jobs]. I've tested basic firewall rules on my VM and they seem to work split on Win7 but I wonder if there is something they know that I haven't seen yet? Also under one of the "Critical System Services" lists I found they list Dcom & PnP were there. So, while all four of those seem to work fine split on Win7 thus far both cases should likely be kept in mind for any future oddities noticed?
  
  Update 2:
  After mulling over stuff a bit more today I did manual testing killing services in a Win7 VM and found that it was pointless to split DcomLaunch, PlugPlay and Power. Killing any of these three requires a reboot anyway so I've restored them as shared in my sysprep vm. There didn't seem to be any harm in having them separate, just not much help either.
  I'm still not seeing any reason to keep BFE and MpsSvc shared like there were in Win10 CU. I just don't see why the firewall crashing or getting killed should take out the entire BFE with it so I think I'll retain the split for them on my end unless I notice something down the line.
  Replaced attached .bat to account for this change.
• nuhi

  June 2017

  Thanks for the additional info.
  
  Potentially FW and BFE have either the performance or security benefit of staying grouped, I would ask MS if you want to be certain, but you would need a direct to dev contact, no one else will know the answer.
  
  I have 4 under DCOM, and 3 under Service Host: Local Service (includes FW/BFE and core messaging). All else split or removed.
  
  Also another point making me reluctant from adding this option, is the fact that RpcSs fails if split, which means there is something else going on, not just saving memory. And the same might trigger in FW/BFE in some situation.
  
  I do like the idea, please keep me updated.
  
  Thanks.
• e_web

  July 2017

  I actually went from the VM to a live version about a week ago now. Haven't seen any other issues. It looks like you may have been working off a Win8 image with the core messaging being included. I haven't gotten to that yet but I'm not a huge fan of 8 anyhow.
  
  I mostly kept it similar to the way Win10 CU splits them. I kept the 'critical' services grouped which of course includes RpcSs as you mentioned. Even windows 10 doesn't split them and as I noted it didn't work when I tried either on 7
  
  
  
  
  In the end, for my Win7 build, I kept these grouped:
  DcomLaunch, Power, PlugPlay (same as Win10 CU)
  RpcSs and RpcEptMapper (same as Win10 CU)
  WdiSystemHost and UxSms (to retain proper Aero functionality 100% of the time)
  
  
  
  
  I don't currently have the BFE and MpsSvc grouped. I did test the firewall to ensure both inbound and outbound rules and policies still functioned but there obviously wouldn't be any harm keeping them together like MS did in Win10 CU just in case.
  
  It seems as though all else can be split on Windows 7 just like on the Win10 CU.
• j_b_norman

  July 2017

  I forgot this existed, thanks for the reminder and your due diligence