Skip to content

Instantly share code, notes, and snippets.

@spddl
Last active December 6, 2022 12:26
Show Gist options
  • Save spddl/7e0f22c0cc696358581974a14d020ac4 to your computer and use it in GitHub Desktop.
Save spddl/7e0f22c0cc696358581974a14d020ac4 to your computer and use it in GitHub Desktop.
# https://web.archive.org/web/20190115225109/https://blogs.technet.microsoft.com/askperf/2008/01/11/getting-started-with-svchost-exe-troubleshooting/
$IsolatedServices = @("AudioSrv", "AudioEndpointBuilder")
$SvchostPath = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost'
$ServicesPath = 'HKLM:\SYSTEM\CurrentControlSet\Services'
function Register-NewGroup {
param(
[string]$Path,
[string]$Group
)
$line = (Get-ItemProperty -Path $Path -Name ImagePath).ImagePath
$first = $line.IndexOf('-k ')
if ($first -eq -1) {
return
}
$firstPart = $line.Substring(0, $first + 3)
$second = $line.IndexOf(' ', $first+3)
if ($second -eq -1) {
Set-ItemProperty -Path "$Path" -Name $ImagePath -Value "$($firstPart)$($Group)" -Type ExpandString
}
$secondPart = $line.Substring($second, $line.Length - $second)
Set-ItemProperty -Path "$Path" -Name ImagePath -Value "$($firstPart)$($Group)$($secondPart)" -Type ExpandString
}
Get-Item -Path $SvchostPath | Select-Object -ExpandProperty Property | ForEach-Object {
$value = (Get-ItemProperty -Path $SvchostPath -Name $_).$_
ForEach ($isoServ in $IsolatedServices) {
$found = $False
if($value -contains $isoServ) {
$found = $True
$value = $value.replace($isoServ,'')
}
if ($found) {
Set-ItemProperty -Path $SvchostPath -Name $_ -Value $value -Type MultiString
}
}
}
ForEach ($isoServ in $IsolatedServices) {
New-ItemProperty -Path $SvchostPath -Name "Isolated_$isoServ" -Value $isoServ -Type MultiString
Register-NewGroup "$ServicesPath\$isoServ" "Isolated_$isoServ"
Set-ItemProperty -Path "$ServicesPath\$isoServ" -Name Type -Value 16 -Type DWord
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment