31

I was trying to close a non-responsive process, and after the first time I clicked "End Process", nothing happened. So I did it again and this time a window popped up saying "Access is Denied". Eventually the process did close, but this got me thinking..

If I had ran task manager as an administrator, would it have still gave me this "Access is Denied" message? Or, in-fact, does Windows 10 run task manager as an administrator by default (when the user account is an administrator). Furthermore, is there any difference between running it as administrator or not?

Running it as admin via this method:

I don't see any noticeable differences between that and just doing Ctrl+Shift+Escape.

Note: This question is specifically for Windows 10 (and possibly 8/8.1) and I am running Pro. Also, my UAC set to 'Never notify'.

Improve this question
5
  • If UAC is off and you use Administrator account, then each process you start runs with Administrator privileges.
    – Alexey Ivanov
    Jan 20, 2016 at 9:32
  • @AlexeyIvanov I don't believe that's true. Maybe some, but not all processes and applications..
    – Insane
    Jan 20, 2016 at 9:38
  • 2
    You're right: that's changed with Windows 8: The behavior of UAC for the "Never notify" setting no longer disables UAC. The "Never notify" setting gives you a split token and always automatically elevates the privilege required. … You can still disable UAC by using Group Policies or manually setting the registry key. Source: User Account Control. But if you disable UAC completely, then all processes are started with Administrator privileges.
    – Alexey Ivanov
    Jan 20, 2016 at 10:06
  • 1
    @AlexeyIvanov And now that I've disabled UAC from Group Policy, you're right! Everything is running elevated now.
    – Insane
    Jan 20, 2016 at 10:21
  • Yep. Though IIRC Windows Metro apps are dependant on not elevating.
    – qasdfdsaq
    Jan 20, 2016 at 13:25

3 Answers 3

Reset to default
37

Does task manager run as administrator by default on Windows 10?

Only if it is being run from an administrator account. Ben N's answer below has a great explanation of how this is actually implemented.

If I had ran task manager as an administrator, would it have still gave me this "Access is Denied" message?

Yes. There are plenty of processes that even an administrator is not permitted to end. Furthermore, trying to end a non-existent task also produces this error message.

If the reason you had got the "Access is Denied" message was due to Task Manager not running as Administrator, you would get this very explicit message telling you so:

enter image description here

Furthermore, is there any difference between running it as administrator or not?

Yes, but you'd have to run it from a non-administrator account to see it.

Incidentally all the above behaviours are exactly the same as in Windows 8/8.1

Improve this answer
5
  • 1
    Indeed it is. Covers all points, but I'm inclined to give 48 hours for other answers to have a chance (as I've got yelled at on multiple occasions for accepting too soon :)
    – Insane
    Jan 19, 2016 at 23:38
  • In my experience, this is usually happens when a process is stuck waiting for a kernel-mode I/O request to complete. See “Access denied” when trying to end a process on Windows 8
    – Christopher Oicles
    Jan 20, 2016 at 3:01
  • It is possible to end those processes if you start taskmgr as SYSTEM though, by using "psexec -d -i -s taskmgr"
    – Drakarah
    Jan 20, 2016 at 13:22
  • 1
    @drake7707 Actually, protected processes cannot be terminated or even write-DAC'd from user mode, even if you're running as SYSTEM. I don't believe user mode can authoritatively deal with processes that are hung in kernel mode either; you have to close all the handles (see another of my answers) and wait for all kernel-mode requests to complete.
    – Ben N
    Jan 20, 2016 at 14:15
  • @BenN More generally, at the point of something in the kernel hanging; don't you potentially have much more serious problems than just an application unable to be terminated by any safe means.
    – Dan Is Fiddling By Firelight
    Jan 20, 2016 at 16:15
19

The existing answer is very good. I'll provide some technical details, for those that like such things.

Taskmgr.exe (in \Windows\System32) is the program that is run when you call for Task Manager. Inspecting it with a hex editor, I discovered that its manifest sets requestedExecutionLevel to highestAvailable. This means that if you are running as a local admin, Task Manager will require you to elevate. You can easily demonstrate this by setting UAC to the highest level and pressing Ctrl+Shift+Esc to launch Task Manager, noting that it produces an elevation prompt. If UAC is not at the highest level, Task Manager can silently elevate because it's an integral Windows component. In short, yes, Task Manager runs as admin by default when possible.

highestAvailable (as opposed to requireAdministrator) allows non-admins to run the program without being asked to elevate, but they of course won't be able to do anything administrative from it.

A quick-and-dirty way to see if a program is running elevated is to enable the UAC virtualization column in the Details tab of Task Manager. If and only if a process's entry in that column is Not allowed, then it is elevated. (Administrative processes cannot be compatibility-redirected.) You could also check whether it has the powerful privileges (e.g. SeSecurityPrivilege) using Sysinternals Process Explorer.

In response to your question about still being denied access to some processes, Windows has a concept of protected processes that absolutely cannot be touched from user mode, not even by processes running as SYSTEM; the protection is enforced by the kernel. Only essential system services get this kind of guarding. One such process is csrss.

Improve this answer
3
  • 2
    A lot of antivirus applications (including Microsoft's own) are also protected.
    – qasdfdsaq
    Jan 20, 2016 at 12:23
  • because it's an integral Windows component Sounds like a way for malware to launch with admin priveleges without a UAC prompt... I wonder how a game manages to get such security enforced by the kernel.
    – CausingUnderflowsEverywhere
    Oct 4, 2016 at 19:10
  • @CausingUnderflowsEverywhere To tamper with the logic that chooses what an "integral Windows component" is, malware would have to already be running as administrator, though there are several other UAC bypass exploit strategies known. Also, I believe the Application Information service (a user-mode program) is responsible for handling elevation requests.
    – Ben N
    Oct 4, 2016 at 20:29
1

I've discovered another possible cause of this error message, which is not something I would have ever thought to check for when troubleshooting an error of "Access Denied".

Background

Microsoft introduced a new resource management mechanism, beginning in Windows 8. When the system's resources are in high demand, Windows may choose some processes to place into a "Suspended" state, in order to free up their resources for other processes. A Suspended process is essentially frozen until the system un-suspends it, which most commonly occurs in response to the user initiating an interaction with that process. For whatever reason, Task Manager is not exempt from this mechanism, and in fact it has a particularly unexpected behavior: when Windows puts taskmgr.exe into the Suspended state, its "Update Speed" setting also gets altered, from whatever you had it set to, to Paused. However, when the process is un-suspended, the "Update Speed" setting is not restored to its original value - it stays on the Paused setting!

Error Cause

When Task Manager's "Update Speed" is set to Paused, the Details tab can show processes that are no longer running. If this is the case, and you attempt to "End Process" on such a nonexistent process, you'll get the "Access Denied" error. The (short-term) solution* is to ensure that the "Update Speed" is set to something else, like Normal, before attempting to end a process.

 

*As for the long-term solution of preventing the "Update Speed" setting from switching to Paused in the first place (which happens constantly)... I'm still searching for that one!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .