To check the memory of individual services, you will have to change the types of services to "Own process". This Gist shows the complete code. The main idea is to try to change the type of service from the least intrusive to the most intrusive way:
$win32Service = Get-CimInstance -ClassName Win32_Service -Filter "Name = '$ServiceName'" -Verbose:$false
if ($win32Service)
{
if (!(Set-ServiceTypeToOwnProcessByCim $win32Service))
{
if (!(Set-ServiceTypeToOwnProcessByWindowsRegistry $win32Service))
{
if (Grant-FullControlRightsOnServiceRegistryKeyToCurrentUser $win32Service)
{
Set-ServiceTypeToOwnProcessByWindowsRegistry $win32Service | Out-Null
}
}
}
}
else
{
Write-Warning "[$ServiceName] Service not found"
}
Set-ServiceTypeToOwnProcess.ps1 Enable-Privilege.ps1 script :
.\Set-ServiceTypeToOwnProcess.ps1 -ServiceName 'Appinfo', 'gpsvc', 'Schedule', 'SENS', 'SessionEnv', 'wuauserv'