A pain in my side over the past year finally forced me into addressing it. Windows Module Installer runs as TrustedInstaller.exe and for most cases just does its job which is to keep in touch with the Windows Update service and apply the updates sent to it.

Occasionally they develop a memory leak and consume RAM until someone intervenes. We have about 140 servers. About 22 over the past two months about 20 showed this behavior. Only when it uses about 2GB of the 10GB we allocated to these servers do I usually have to intervene. That has been about 3 times over the past 2 months and ten over the past year.

Using Yaketystats to see the trend was far worse than I had noticed, I decided we needed to do one of two things.

1. Shut it down. Start them when we need them. Shut them down again when we do not. Benefit is we do not have to worry about them getting out of control consuming resources. Unfortunately those wanting to push out updates will have to add a step to start them before pushing them.
2. Recycle. Routinely shut them down and start back. Relatively easy to automate, so set it and forget it. Recycle

Well, it gets much worse. First, running the commands work inconsistently. For example, I ran

Set-Service TrustedInstaller -startuptype “Automatic”

against every host in a development system. As is my habit, I ran a check to make sure it worked. It did on two of the five. So I ran it again. The other three were fixed. So I did that same process on another development system with five hosts. Three of the five worked the first time and the other two the second. The pattern held true for another three systems all with five servers each. Setting the startuptype to Manual worked the same inconsistent way.

My check:

Get-WmiObject -ComputerName $computer win32_service -Filter “name = ‘trustedinstaller’”

Second, stopping and starting them does not appear to stick. Several minutes after I have stopped all of the services they appear to back in the prior state. Those who were not running stay not. Those who were running are again. And if I start all of them, then at some point those who were not running stop again.

Guess I have a lot of research ahead of me. 🙁