Why does it take Task Manager longer to appear when you start it from the Ctrl+Alt+Del dialog?

Raymond Chen

Amit was curious why it takes longer for Task Manager to appear when you start it from the Ctrl+Alt+Del dialog compared to launching it from the taskbar. Well, you can see the reason right there on the screen: You’re launching it the long way around. If you launch Task Manager from the taskbar, Explorer just launches taskmgr.exe via the usual Create­Process mechanism, and Task Manager launches under the same credentials on the same desktop. On the other hand, when you use the secure attention sequence, the winlogon program receives the notification, switches to the secure desktop, and displays the Ctrl+Alt+Del dialog. When you select Task Manager from that dialog, it then has to launch taskmgr.exe, but it can’t use the normal Create­Process because it’s on the wrong desktop and it’s running under the wrong security context. (Because winlogon runs as SYSTEM, as Task Manager will tell you.) Clearly, in order to get Task Manager running on your desktop with your credentials, winlogon needs to change its security context, change desktops, and then launch taskmgr.exe. The desktop switch is probably the slowest part, since it involves the video driver, and video drivers are not known for their blazingly fast mode changes.

It’s like asking why an international package takes longer to deliver than a domestic one. Because it’s starting from further away, and it also has to go through customs.


Discussion is closed.

Feedback usabilla icon