Why does it take Task Manager longer to appear when you start it from the Ctrl+Alt+Del dialog?


Amit was curious why it takes longer for Task Manager to appear when you start it from the Ctrl+Alt+Del dialog compared to launching it from the taskbar.

Well, you can see the reason right there on the screen: You’re launching it the long way around.

If you launch Task Manager from the taskbar, Explorer just launches taskmgr.exe via the usual Create­Process mechanism, and Task Manager launches under the same credentials on the same desktop.

On the other hand, when you use the secure attention sequence, the winlogon program receives the notification, switches to the secure desktop, and displays the Ctrl+Alt+Del dialog. When you select Task Manager from that dialog, it then has to launch taskmgr.exe, but it can’t use the normal Create­Process because it’s on the wrong desktop and it’s running under the wrong security context. (Because winlogon runs as SYSTEM, as Task Manager will tell you.)

Clearly, in order to get Task Manager running on your desktop with your credentials, winlogon needs to change its security context, change desktops, and then launch taskmgr.exe. The desktop switch is probably the slowest part, since it involves the video driver, and video drivers are not known for their blazingly fast mode changes.

It’s like asking why an international package takes longer to deliver than a domestic one. Because it’s starting from further away, and it also has to go through customs.

Comments (39)
  1. Mark says:

    Not forgetting Ctrl+Shift+Esc as a shortcut for the taskbar method, I use it all the time! blogs.msdn.com/…/shortcut-tip-ctrl-shift-esc-and-ctrl-alt-end.aspx – I presume this shortcut is still handled by Explorer and not winlogon.

  2. Leo Davidson says:

    Re the video mode switch, is it not possible for Windows to just change the framebuffer without changing the full video mode?

    It seems like a very slow operation to switch mode from A to B when A and B are exactly identical (resolution, refresh rate, color depth) except for the location of the framebuffer in memory.

    It slows things down further by causing most monitors to re-sync to the new mode, even though all that's changed from the monitor's perspective is the pixel colors.

    Is this some unfortunate legacy thing, that still hasn't been improved with newer driver models, or is there some underlying issue keeping things this way? (e.g. Security between desktops or something?)

    [I have no idea, but it pisses me off too. -Raymond]
  3. mvadu says:

    Raymond, if the system can switch to secure desktop (to show the alt+ctrl+del) fast enough then user expectation would be to get task manager launched equally fast. Its like UPS overnight package, whether I am sending it to west coast or to London I am expecting them to deliver it the next day.

  4. Roman says:

    The obvious question is surely "So why does the display driver get involved in the desktop switch", which is something that I've wondered for some time. I know this isn't quite your area, Raymond, but perhaps you happen to know anyway?

  5. @LtCmdrKeene says:

    mvadu – switching to the secure desktop isn't speedy for me. When I press the SAS, it takes about a full second before I see the secure desktop. Sometimes it's slower for me. This (along with a more direct route) is why I always use Ctrl-Shift-Esc to get to the Task Manager.

  6. Pingback from  Dew Drop – January 30, 2012 (#1,254) | Alvin Ashcraft's Morning Dew

  7. Jedak says:

    I'm with Mark and @LtCmdrKeene. I use Ctrl-Shirt-Esc almost exclusively.  In fact, in my office it's been dubbed the chicken salute due to the fact that if you use the Left Ctrl key and the Left Shift key, your hand looks like a rooster shadow puppet.  This assumes you use your thumb, first and middle fingers for the Left Ctrl, Left Shift and Esc respectively.

  8. gigi says:

    Like others said, why does the graphical mode needs to be changed?

    It looks like Windows 8 solved some of these issues – switching between metro/classic desktop doesn't seem to change the graphical mode. Or rotating the screen for that matter.

  9. Dan Bugglin says:

    Switching between metro and classic desktop isn't the same.  Metro probably simply overlays the classic desktop like any app would, I imagine.

  10. Tim says:

    I've always assumed the video mode has to be changed because various graphics acceleration features are turned off to give malware less surface area in the video driver to be able to display their own content to the secure desktop. This is just a guess, it would be nice to know if this is the actual reason or not.

  11. blah says:

    The mode change is one of Vista's many WTFs that remains in 7 sadly.

  12. DWalker59 says:

    The video mode switch is getting slightly off the topic of the post, but one of the UAC settings will show the prompt without doing the video overlay.  I think the dialog box says "in case the video switch takes too long" (or something to that effect).  How a video mode switch would have any functional interaction with security is certainly a weird area.

  13. Joseph Koss says:

    I am almost certain that its a video bios and driver reset, not just a video mode switch.

  14. Skyborne says:

    I may be technically uninformed, but this is the Internet, so: if you want the secure desktop to be secure, you must have the graphics card in a known state.  Such as you can get by saving all its state and fully replacing it with a fresh mode/framebuffer.

    Or, you can set your time machine for the dawn of 3D acceleration and go convince the DOS driver teams that it would be worthwhile to support graphics multitasking in hardware from the beginning, in spite of whatever hit to frame rate and price this may cause.

  15. The display driver reset has been there since XP. I guess it's designed into the TS switch. Some evil drivers take enormous timeouts for the chip reset.

  16. Miff says:

    @Mark – I'm also firmly in the Ctrl+Shift+Esc camp for launching Task Manager, but according to Process Explorer, it's still launched by Winlogon.exe.  Then again, I tend to leave Sysinternals Process Explorer running minimized to my notification area, so I tend to just hit that when I need to check CPU or kill a process.

  17. xpclient says:

    And that video mode reset, some display drivers for certain graphics chips from at least two major manufacturers (Intel and NVIDIA) hang at the black screen while doing the switch so the only way to recover is hard reset. I have stopped using Fast User Switching because of this on Vista/7.

  18. Aardvark says:

    Best way is to load task manager minimized at startup with 'Hide when minimized' option checked so subsequent Ctrl+Shift+Escs are fast, plus you can constantly keep a tab on CPU usage from the tray.

  19. Nick says:

    Yes, Winlogon handles the CTRL+SHIFT+ESC shortcut (this is one reason I use it — the fact that Explorer doesn't launch it means it usually starts up faster (winlogon.exe has High priority and doesn't host a million extensions) and it's also available when Explorer isn't running (very useful when you close Explorer and then need to start it).

    Why anyone would start Task Manager with CTRL+ALT+DEL is beyond me.

    @Jedak:

    I just tried to hit the keys in the way you describe and it was almost painful.  I just mash CTRL and SHIFT with my thumb and hit ESC with my index finger :)

  20. Jolyon Smith says:

    "It's like asking why an international package takes longer to deliver than a domestic one. Because it's starting from further away, and it also has to go through customs."

    Which makes it all the more curious when international packages arrive MORE QUICKLY than domestically shipped ones (shipped at the same time or even later!).  :)

    Not relevant to the discussion, just saying.  :)

  21. Andrew says:

    This is the WORST when you hit CTRL+ALT+ESC to bring up Task Manager in order to kill a process that's taken over your PC.

    Even though Task Manager is supposedly running at a higher priority than the other processes, including the one that's chewing all of your CPU, it still takes forever or sometimes won't appear because the PC is too busy wasting CPU.

    :(

  22. jb says:

    @xpclient

    Thanks for that, that probably explains my multiple hang-at-black-screen issues I get with the wife switching to her profile.

    Now off to google "disable fast user switching"

    JB

  23. Hmm, but using the Radeon drivers, the mode change on CTRL+ALT+DEL is really smooth and fast. Well, I guess in amongst all the other bugs, they have to get something right.

  24. Anonymous Coward says:

    I'm running Windows XP (like the one who originally asked the question) and 1) the Ctrl+Alt+Del window doesn't appear when I press Ctrl+Alt+Del but Task Manager is launched directly and 2) there seems to be no difference compared to launching it any other way; I experience no delay. This seems to also be true if using Process Hacker instead of Task Manager.

    Hypothesis: if the Ctrl+Alt+Del window isn't displayed, no switch to the secure desktop needs to be done and the straight call can be used. Since the Ctrl+Alt+Del window isn't useful in practice you'd probably want to turn it off. Unintuitively, he only way (known to me) to do this is by turning the welcome screen on, which is the default setting.

  25. Amit says:

    Thanks for the answer, Raymond. I hadn't considered how much extra work was needed and definitely had no idea the video driver was involved in it. Interesting.

  26. @Anonymous Coward

    Yes, Windows XP launches Task Manager directly when you press Ctrl+Alt+Del if you have Welcome screen and Fast User Switching (as if you pressed Ctrl+Shift+Esc).

    The things have changed in Vista/7: it nevertheless displays the secure desktop.

    But it means that Vista and 7 behave identically in Home and Corporate environment.

  27. ender says:

    Hmm, but using the Radeon drivers, the mode change on CTRL+ALT+DEL is really smooth and fast.

    I don't think Ctrl+Alt+Del involves a mode switch – it's fast on all my computers. Try locking your computer instead and pressing the "Switch User" button – you should see a delay there (note: since you have a Radeon, exit any 3D application before doing that, because you might get a BSOD otherwise).

  28. Neil says:

    On some versions of Windows, you can change the display settings for your session even if you log in as a limited user, but the secure desktop will retain the previous administrator's settings. The mode switch is very noticeable in that case! I would have to assume that the mode switch is requested without checking to see whether the mode is already correct.

  29. Someone says:

    @jas88:I seem to remember letting users change display settings is an accessibility requirement: visually impaired users may need a lower resolution, bigger fonts, etc

    Yes, but as Neil said: I would have to assume that the mode switch is requested without checking to see whether the mode is already correct.

  30. 640k says:

    This is not the fault of the drivers. It's the fault of windows architecture, which CANNOT switch desktop/resolution speedy even with a null driver. Windows isn't optimized for this scenario. There's no hardware or drivers hindering windows to switch desktop a million times per second if that would have been prioritized. I guess it's a -100 feature as usual, no need to blame other for your own shortcomings.

  31. Joren says:

    I'm not sure if the video mode switch is related, but a full screen video game that's locked up and refuses to let me see the task manager after I press Ctrl Shift Esc often does get out of the way just enough to kill the process after going through Ctrl Alt Del and starting the task manager from there.

  32. I seem to remember letting users change display settings is an accessibility requirement: visually impaired users may need a lower resolution, bigger fonts, etc. We used to have that blocked in policies, and had to unblock it for exactly that reason.

    Device drivers have always been a major source of pain. Graphics drivers have a complicated and essential job to do, which at least partly explains the problems though doesn't excuse them, but printer and wireless drivers can be as bad; I recall a few years ago a particularly wonky driver for a colour laser printer managed to trash the (Win XP) machine to the point of reinstalling. Switching to a generic Postscript driver on each client and having the server interpret that was a huge improvement in many ways. My brother bought a cheap mono laser from the same company; it was quite depressing to discover their "driver" went and installed its very own *web server*, among other things. Written in Java, so it installed its own JVM, too. Buggy, so it would sometimes live lock and max out the CPU until killed … all that, just to pump an 8 megapixel 1bpp bitmap down a USB cable occasionally!

    Maybe more sensible and reliable card-reset handling could be included in the next hardware Windows logo requirements, if it's not already. Being able to draw a zillion triangles per second more than the other guy's card doesn't save the user much time when your lousy drivers crash and force a reboot, or just keep the user waiting randomly for trivial changes!

  33. DWalker59 says:

    When switching resolutions, Windows might need to notify every application so they can redraw their dialog boxes if necessary.  I don't think you should EXPECT that a change of screen resolution would be a trivial thing.

  34. yuhong2 says:

    "I don't think Ctrl+Alt+Del involves a mode switch – it's fast on all my computers. Try locking your computer instead and pressing the "Switch User" button "

    FYI, Ctrl+Alt+Del involves only a desktop switch, while "Switch User" involves a session switch.

  35. @jb:

    "Thanks for that, that probably explains my multiple hang-at-black-screen issues I get with the wife switching to her profile."

    Are you, by any chance, running XP Gold? It had such a bug.

  36. f0dder says:

    @640k: hm, *resolution* switching has always been slow on every OS I've seen (depending a bit on how fast the monitor adapts to it… or so it seems) – *desktop* switching doesn't necessarily mean resolution switching, though.

    While I find the slow switches annoying like the rest of you, there's a certain level of comfort in it as well. Takes more effort to fake a UAC prompt when you also have to fake a slow mode-switch (if you're privileged enough to DO a modeswitch, you probably don't need to fake UAC?).

  37. ender says:

    if you're privileged enough to DO a modeswitch, you probably don't need to fake UAC?

    I don't think a resolution change needs administrative privileges.

  38. ender says:

    if you're privileged enough to DO a modeswitch, you probably don't need to fake UAC?

    I don't think a resolution change needs administrative privileges.

    (Speaking of fake UACs, I've seen some [real] antivirus software do that on XP when you run the uninstaller.)

  39. Neil says:

    I had to install some video drivers after a hardware change. (In general, when installing drivers, network comes first, so that you can download video drivers, so that you can actually see what you're doing…) The driver installer asked me to reboot, so I accepted. The shutdown screen, on the secure desktop, already started using the correct resolution…

Comments are closed.