taskmgr.exe called with an argument by Windows 7

Question

I noticed when I press Ctrl+Alt+Del and click Task Manager, Windows calls taskmgr.exe /3 as the command. Several websites claim the Task Manager has no command line arguments.

Why does Windows attach this argument?

Answer 1

Analysis

Apparently it's not a documented behavior. I did some tests, and noted my findings:

• Right-click the taskbar, and click Start Task Manager.

  "C:\Windows\system32\taskmgr.exe" /4
  

• Press Ctrl+Shift+Esc.

  taskmgr.exe /2
  

• Press Ctrl+Alt+Del, and click Start Task Manager.

  taskmgr.exe /3
  

• Start a non-elevated Task Manager, and click the Show processes from all users button.

  "C:\Windows\system32\taskmgr.exe" /1
  

• Type or paste taskmgr.exe in the Start menu search bar, and press Enter; press Win+R, type or paste taskmgr.exe in the textbox, and press Enter; navigate to the System32 folder and double-click the taskmgr.exe executable; start the System Configuration utility (msconfig.exe), click the Tools tab, select the Task Manager item from the list, and click Launch.

  "C:\Windows\system32\taskmgr.exe"
  

• Open a command prompt, type or paste taskmgr.exe, and press Enter.

  taskmgr.exe
  

Remarks

• Things worked in a similar way during the development phase of Windows 8, up until the Release Preview. Windows Vista and earlier operating systems are unaffected.

• The executable imports a couple of API functions (namely GetCommandLineW and CommandLineToArgvW) which are used to retrieve and parse command line arguments.

• Manually starting the program using any of the arguments above doesn't seem to have any noticeable effect.

If I had to make an educated guess, I'd say that the numeric parameter was meant to be an internal startup indicator, possibly used for debugging purposes and then left behind.

Answer 2

A few notes:

Just because a command is sent, does not mean that a program accepts those arguments, or any.

For example:

I called taskmanager with my own odd command and the behavoir did not change:

From a basic programming stand point, any application is going to have a main method of some sort where arguments can be passed in. For example a basic Windows Form C# application looks something like:

private void Form1_Load(object sender, EventArgs e)
        {

        }

If I pass some funny arguments in, nothing happens with the application, but Process Explorer will catch and display them.

If I explicitly decide to handle them however, you will get interaction from the command.

And all I had to do was change the entry point of the form slightly:

private void Form1_Load(object sender, EventArgs e)
        {
            string arguments = Environment.GetCommandLineArgs()[1];

            this.Text = arguments;
        }

Now, back to your question on why it is there:

If you access taskmgr.exe from the ctrl + alt + del method, you do indeed see the command argument "/3". Also if you use ctrl + shift + esc it passes /2 and if you right click the taskbar and click "Start Task Manager" the switch shown is /4.

All of this leads me to assume maybe there is something that Windows needs to know, or perhaps was nearly implemented for the Taskmanager that we don't know about. For example, security in Windows might want to know if ctrl + alt + del was used to call taskmgr.exe and not a script or user. Again, pure speculation but threads like this make me think it might have been at least a thought.

---

For the infamous tl;dr

To know why Windows passes these commands we likely need either a member of Microsoft's development team, or the source code. There might not be a better answer.