Amit was curious why it takes longer for Task Manager to appear when you start it from the Ctrl+Alt+Del dialog compared to launching it from the taskbar.
Well, you can see the reason right there on the screen: You’re launching it the long way around.
If you launch Task Manager from the taskbar, Explorer just launches taskmgr.exe
via the usual CreateProcess
mechanism, and Task Manager launches under the same credentials on the same desktop.
On the other hand, when you use the secure attention sequence, the winlogon
program receives the notification, switches to the secure desktop, and displays the Ctrl+Alt+Del dialog. When you select Task Manager from that dialog, it then has to launch taskmgr.exe
, but it can’t use the normal CreateProcess
because it’s on the wrong desktop and it’s running under the wrong security context. (Because winlogon
runs as SYSTEM, as Task Manager will tell you.)
Clearly, in order to get Task Manager running on your desktop with your credentials, winlogon
needs to change its security context, change desktops, and then launch taskmgr.exe
. The desktop switch is probably the slowest part, since it involves the video driver, and video drivers are not known for their blazingly fast mode changes.
It’s like asking why an international package takes longer to deliver than a domestic one. Because it’s starting from further away, and it also has to go through customs.
0 comments