Why does it take Task Manager longer to appear when you start it from the Ctrl+Alt+Del dialog?
Amit was curious why it takes longer for Task Manager to appear when you start it from the Ctrl+Alt+Del dialog compared to launching it from the taskbar.
Well, you can see the reason right there on the screen: You’re launching it the long way around.
If you launch Task Manager from the taskbar, Explorer just launches
taskmgr.exe via the usual
CreateProcess mechanism, and Task Manager launches under the same credentials on the same desktop.
On the other hand, when you use the secure attention sequence, the
winlogon program receives the notification, switches to the secure desktop, and displays the Ctrl+Alt+Del dialog. When you select Task Manager from that dialog, it then has to launch
taskmgr.exe, but it can’t use the normal
CreateProcess because it’s on the wrong desktop and it’s running under the wrong security context. (Because
winlogon runs as SYSTEM, as Task Manager will tell you.)
Clearly, in order to get Task Manager running on your desktop with your credentials,
winlogon needs to change its security context, change desktops, and then launch
taskmgr.exe. The desktop switch is probably the slowest part, since it involves the video driver, and video drivers are not known for their blazingly fast mode changes.
It’s like asking why an international package takes longer to deliver than a domestic one. Because it’s starting from further away, and it also has to go through customs.