Pale Musings

Replacing Task Manager with Process Explorer on Windows 7 64bit

I’ve happily used Process Explorer for several years using the replace task manager function whenever I can.  When I moved to the 64 bit version of Windows 7, the functionality to replace the task manager began failing.  It would appear to work; however, when invoking task manager by right clicking on the start bar I would always see the error that it could not find taskman.exe.

Today I learned that the method used for replacing task manager is called Image File Execution Options.  Basically, via an entry in the registry, calls for the execution for one program are substituted with a call to another.  When you use the “Replace” functionality within Process Explorer, it creates the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

That key has this value:

Debugger:  "C:\SYSINTERNALS\PROCEXP64.EXE"

The problem arises due to the way Process Explorer works on 64 bit systems.  When you run PROCEXP.EXE, it creates the 64 bit stub PROCEXP64.EXE as a temporary file.  While I admit to not understanding fully why it does this, the issue that causes the problem is that Process Explorer also deletes that file when it exits, so the substitution will not work.  The error message is a bit misleading, but it at least makes sense now.

Simply replacing the value of the Debugger key with PROCEXP.EXE instead of PROCEXP64.EXE fixes the issue.

NOTE: As always, messing with the registry should be done at your own risk and may cause problems with your system.

September 29, 2010 - Posted by palehorse | Miscellaneous