Isolate a Svchost.exe Process in Task Manager

Mark Berry January 31, 2015

On my Windows 7 SP1 x64 workstation, I had a svchost.exe process that kept growing in size. In Task Manager its Commit Size was up to 2.5GB before I rebooted. I was shopping for additional RAM but then decided to see if I figure out if it was a software issue.

The problem with svchost.exe is that it can host multiple services. How do you know which one is the problem?

This SuperUser answer gave me two important clues:

  • The Network Store Interface (nsi) is a common cause of this memory leak issue.
  • To confirm, there is a way to isolate a service into its own svchost.exe instance. Once isolated, if that instance keeps increasing in memory usage, that’s the one with memory leak.

Isolating the Service

That SuperUser answer referred to a StackOverflow answer on isolating a service, which in turn refers to this TechNet blog post. All I had to do was run this from an elevated command prompt:

sc config nsi type= own

After rebooting, I was able to follow that PID in Task Manager for a few days, confirming that its memory usage was increasing by about 400K per day, soon surpassing 1GB with no end in sight. In my case, applying the hotfix from 2847346 seems to have fixed the issue—after a couple days, that svchost.exe process is hovering around 4K. Better!

With that bug fixed, I’ll now run this command to set nsi back to being a shared process:

sc config nsi type= share


Leave a Reply





*