How does Task Manager choose the icon to show for a process?

When you view the list of Processes in Task Manager, each entry gets a little icon. Where does that icon come from?

If the process has a visible window, then Task Manager uses the icon of the window.

If the process has no visible windows, but it has a notification icon, then Task Manager uses the notification icon.

If the process has no visible windows, nor does it have a notification icon, then Task Manager uses the default icon for the underlying executable.

There is also a special hard-coded list of icons for certain processes, such as svchost.exe.

A customer had a process which showed only a notification icon most of the time, so they ended up at step 2: Task Manager uses the notification icon. Their notification icon was designed to look good against a dark background (which is the default for the notification are), but it looks bad on a light background (which is the default for Task Manager). They were hoping for a way to specify a custom icon just for Task Manager.

Sorry. There is no custom override just for Task Manager. Maybe you can tweak your notification icon so it looks good both in the notification area and in Task Manager. You probably should do that anyway, because the background color of the notification area will not always be dark; users can customize it to something light, and now your notification icon looks bad everywhere.

Comments (24)
  1. skSdnW says:

    How would a 3rd-party task manager get the notification icon of another process?

    1. Joshua says:

      By being in cahoots with the third-party shell.

    2. I don’t believe there is a public way of enumerating notification icons. Task Manager is in cahoots with the notification area. You can use automation, but automation is necessarily tied to UI. if the UI of the notification area changes, then the automation stops working.

      1. skSdnW says:

        As I expected.

        I wish MS would open-source two applications, Notepad and Task Manager. Notepad because it demonstrates most of the common dialogs and would be a nice example application without any secrets to worry about and TM because it would force MS to provide a better public process information API.

        1. Tom says:

          No for the really choice stuff you want Solitaire

        2. The source code to Notepad is embarrassing by modern standards. As you might expect from code written 35 years ago.

          1. henke37 says:

            Won a price tho. So, software development as normal.

          2. Ted M says:

            Notepad is rather exciting though, the .LOG functionality for example. I could have sword Raymond covered that but a cursory Google doesn’t bring it up

          3. SomeGuyOnTheInternet says:

            IMO source code that is still in production 35 years later is – self-evidently – very good source code. It would be very educational to see Notepad’s source code.

        3. Jan Ringoš says:

          Isn’t Notepad basically a single EDIT control?

          1. cheong00 says:

            It evolves a little to add support for Unicode, and the functionality to read Byte-Order-Mark to decide what kind of Unicode the text file is saved (UTF16LE/UTF16BE/UTF8) when reading it.

  2. Andrew says:

    If I were to create a process to directly respond to Raymond off-topic about an amusing Swedish translation by Google, I suppose I could hard code it in such a way that Task Manager chooses the icon to show for the process by adapting the cover of the book pictured at this link:

  3. Jeff says:

    A good example of this is Microsoft’s own OneDrive. The icon, a cloud, is fine on the notification area but disappears in the Task Manager, at least until you hover your mouse over it.

    1. Jan Ringoš says:

      In Vista ~ 8.1 era, the notification icons were white with dark outline and they looked good on any background. That, of course, had to change for some reason.

  4. Roman says:

    What if a process has multiple visible windows with different icons?

  5. ChDF T says:

    The special hard-coded icon for svchost.exe does not seem to do anything special (like changing based on context, etc.). Why doesn’t svchost.exe use that special icon as its default icon?
    I suspect that it is pretty hard to justify a change to a component as critical as the service host, however changing the embedded resources seems like a relatively small change.
    [2nd try; first post failed with error 500]

    1. skSdnW says:

      Services are often console applications and they often don’t have a icon. Still, giving it a icon seems like less work than hard-coding things in Task Manager.

      1. cheong00 says:

        I suspect that due to the number of services hosted in svchost.exe, using a hardcoded in-proc image would be less CPU demanding than have to open these process and seek icon inside.

        1. henke37 says:

          Not really? Icon parsing is icon parsing, no matter the source. Did you mix up cpu time and disk access? If you meant disk access then the I/O manager should learn quickly to predict that part of the file being read.

          1. cheong00 says:

            Read the rules of loading icons again.

            Since svchost.exe runs as service, that means there’s no UI, the first rule does not apply. *

            Since svchost.exe runs as service, and the default environment service run is Session 0, it shouldn’t have notification icon, so the second rule does not apply. *

            So what is expected to run is the third rule – the default icon of the underlying EXE.

            Although the icon is loaded from in-memory image, I suspect this kind of security border transversal is not cheap (You can see Process Explorer which tries to get more data from process can easily get the CPU usage above 10% even if you park the selected item on “System Idle Process”)

            * “Interactive service process” can have UI and notification, but is against Microsoft’s own recommendation so shouldn’t be counted as the norm when considering

  6. Yuri Khan says:

    > Their notification icon was designed to look good against a dark background (which is the default for the notification area)

    What? Since when? I distinctly remember the task notification area background being the 3D Face color. #classictheme4ever

    (But, yes, there are well-known techniques to make your icons visible on any backgroud. A 1px-wide black outline (if your foreground image is light; otherwise white outline) works wonders.)

  7. Calvin says:

    “the background color of the notification area will not always be dark; users can customize it to something light”
    I tested this in Windows 10 and if you try to choose a custom accent color that’s too light, it says “this color is not supported”.

    1. You can’t make it white, but it will go to a light grey colour.

Comments are closed.

Skip to main content