Policy CSP - ServiceControlManager

ServiceControlManager policies



Edition Windows 10 Windows 11
Home No No
Pro No No
Windows SE No No
Business Yes Yes
Enterprise Yes Yes
Education Yes Yes


  • Device

This policy setting enables process mitigation options on svchost.exe processes.

If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them.

These stricter security policies include a policy requiring all binaries loaded in these processes to be signed by Microsoft, and a policy disallowing dynamically generated code.


Enabling this policy could cause compatibility issues with third-party software that uses svchost.exe processes (for example, third-party antivirus software).

If you disable or do not configure this policy setting, the stricter security settings will not be applied.


This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP Friendly name: Enable svchost.exe mitigation options
  • GP name: SvchostProcessMitigationEnable
  • GP path: System/Service Control Manager Settings/Security Settings
  • GP ADMX file name: ServiceControlManager.admx

Supported values:

  • Disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.
  • Enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.

Policy configuration service provider