This tutorial provides step-by-step instructions to change the split threshold for svchost.exe in Windows 10 and Windows 11. It also includes an explanation of what svchost.exe does, what the split threshold is, and why you may want to change it.
How to change the split threshold for svchost.exe
Before you attempt to make changes to the Windows Registry, make sure you back up your Windows Registry data and take a full backup of your system so that you can restore your system to its previous state.
The steps below will work in both Windows 10 and Windows 11.
To change the svchost.exe split threshold using the Windows Registry Editor:
- Open the Windows Registry Editor
- Navigate to the registry path Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
- Update the value of the SvcHostSplitThresholdInKB DWORD by double-clicking it, updating the value data, and pressing OK. Make sure not to include commas in the number, just numeric characters
- Restart your PC to make the change take effect
To set the split threshold so that each svchost.exe process only runs one service (excluding services with hard-coded grouping), you should set the value of SvcHostSplitThresholdInKB slightly higher than the amount of RAM your system has. You can convert GB to KB using the formula [Your System RAM in GB] * 1024 (convert GB to MB) * 1024 (convert MB to KB).
For example, on a Windows PC with 8GB of RAM, you would use:
8GB * 1,024 * 1,024 = 8,388,608KB
Finally, round up to ensure the split threshold is higher than the amount of physical memory, giving a value of 8,400,000.
Troubleshooting svchost.exe split threshold
There are risks involved in changing the split threshold for svchost.exe: modifying the threshold from the default can increase resource usage and impact performance, or cause system stability issues.
You can keep an eye on how svchost.exe is behaving from the Windows Task Manager and Resource Monitor. The Sysinternals Process Explorer can also be downloaded for an even more detailed look at running processes.
If you notice system instability following your changes, restore the SvcHostSplitThresholdInKB value to its default of 380000. If you are unable to do so, you may need to restore from a backup taken before the change was made.
What is svchost.exe and the split threshold?
svchost.exe (the Service Host executable) is a process that is part of the Windows Operating system. It is a vital part of Windows: it allows multiple services (an application that runs in the background) to run under a shared svchost.exe process, with the goal of reducing their collective resource consumption (i.e., RAM and CPU usage).
In short, svchost.exe ‘hosts’ multiple other Windows services under its process. This was originally done to optimize performance on Windows PCs with 64MB-256MB of RAM. Modern PCs have upwards of 4GB of RAM, making the need for this optimization largely unnecessary.
When svchost.exe groups processes, it may appear that a single svchost.exe process has unusually high CPU or memory usage, leading users to think that the process itself is malware, or is malfunctioning. Additionally, If one service running under a svchost.exe process crashes, the entire process crashes along with other services running within it. This can also lead users to mistakenly think svchost.exe itself is the cause of system instability.
Due to these issues, and as modern PCs usually have lots of free memory available, it now makes more sense to group as few services as possible in a single svchost.exe process (ideally, just one service). This is the default behavior on systems with more than 3.5GB RAM in Windows 10 1703 onwards. This can result in many svchost.exe processes being shown in the Windows task manager.
The split threshold is the setting that controls this behavior. It allows you to override when Windows places multiple running services under a single svchost.exe process.
Why modify the split threshold?
The svchost.exe split threshold defines when service processes are split. It is set in KB (kilobytes), and defaults to a value of 380000 (approximately 380MB).
Generally, there is no need for users to adjust the split threshold: Windows devices ship with plenty of memory, and Windows is already optimized for the best general performance. However, some users may want to make changes for the following reasons:
- Forcing a single service for each svchost.exe process to improve stability.
- Reducing resource usage by increasing the grouping of services.
- Troubleshooting by ensuring processes are not grouped, allowing each service to be more easily assessed.
Optimizing fleets of Windows devices in enterprise and education environments
Tweaking the performance of Windows devices using the registry makes sense for enthusiasts working from home, but is not suitable for maintaining and optimizing large numbers of PCs in enterprise and education environments.
Remote monitoring and management (RMM) by NinjaOne gives you oversight over your entire IT infrastructure, including end-user devices and servers. This allows you to monitor for performance issues (including high CPU and RAM usage by svchost.exe processes), and pre-empt problems before they affect your operations and staff productivity. NinjaOne can also automate patching and ensure configuration updates are smoothly deployed to all of your Windows, Apple, Android, and Linux devices.
