Replacing Task Manager with Process Explorer on Windows 7 64bit

I’ve happily used Process Explorer for several years using the replace task manager function whenever I can.  When I moved to the 64 bit version of Windows 7, the functionality to replace the task manager began failing.  It would appear to work; however, when invoking task manager by right clicking on the start bar I would always see the error that it could not find taskman.exe.

Today I learned that the method used for replacing task manager is called Image File Execution Options.  Basically, via an entry in the registry, calls for the execution for one program are substituted with a call to another.  When you use the “Replace” functionality within Process Explorer, it creates the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

That key has this value:

Debugger:  "C:\SYSINTERNALS\PROCEXP64.EXE"

The problem arises due to the way Process Explorer works on 64 bit systems.  When you run PROCEXP.EXE, it creates the 64 bit stub PROCEXP64.EXE as a temporary file.  While I admit to not understanding fully why it does this, the issue that causes the problem is that Process Explorer also deletes that file when it exits, so the substitution will not work.  The error message is a bit misleading, but it at least makes sense now.

Simply replacing the value of the Debugger key with PROCEXP.EXE instead of PROCEXP64.EXE fixes the issue.

NOTE: As always, messing with the registry should be done at your own risk and may cause problems with your system.

Advertisements

2 thoughts on “Replacing Task Manager with Process Explorer on Windows 7 64bit

  1. Pingback: 50226 - Witis Blog

  2. Thank you for taking the time to document this. I had to use a variation of your fix on my system.

    –Created a copy of PROCEXP64.EXE while PE was running on my system.

    –Edited the Debugger key value to point to the copy.

    — I also edited the properties of the copy to Run as Administrator.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s