Process tree in task manager

[idoru]

in fact it's not in task manager but sysinternals process explorer.

Usually and if my memory serves me well, there's :
- system idle process
- then system and it's child processes
- then explorer and it's child processes

Lately I had some explorer crashes resulting in a new and (un) tree like explorer in process explorer. So I did a sfc /scannow that seems to do it's job as the crashes vanished but peeking yesterday in process explorer I noticed that things got screwed a bit...

I still have SYSTEM IDLE PROCESS in the first place, then SYSTEM with some of it's child process BUT with some (previous) explorer processes, then (usually) explorer processes, some with their respective childs as chrome and it's opened tabs, THEN explorer with 4, 5 entries.

Any ideas ?

 

[iko22]

Hello idoru

It sounds like Chrome is using more CPU than Windows Explorer. This is not too unusual. Try closing your Browser, and then re-opening the Browser - notice the difference in Process Explorer?

 

[idoru]

I see where you're getting at but it's not related : the issue isn't CPU time, it's about hierarchy, about which windows 'layer' opens what.
But at least, closing chrome for instance and opening it again, made it child process of explorer, what it is supposed to be, what it was before : a child process launched by explorer (not system).

I'm guessins this is a boot related glitch so I'll try rebooting my rig and see what'll happen.

 

[idoru]

it was in fact an unnoticed explorer crash with it's messed up tree when reloading itself, as I rebooted and everything went back to normal.

The mind boggling thing and pain n the ass is that I get these pretty often these times but on a 6 or 7 years old system with hundreds of installed software + customization + tweaks, it would be useless to try to pinpoint the bad boy...

I've scheduled to make a new modern rig in winter (the actual is unable to let me boot on my 960evo for example (x58a-ud3r)) so rather than porting my old 7 in the process, I'll jump to a fresh new 10 and the essential of what I'm using in this one

 

[iko22]

Is your computer running any customised shell extensions for Windows Explorer? Or do you have extra items in right-click context menu, that have been added by third-party programs?

Use ShellExView | Nirsoft to see what shell extensions are currently installed on your system. Use this program to temporarily disable shell extensions, and pretty quickly diagnose whether these add-ons are the culprit to your problem.

 

[LMiller7]

When a process such as Explorer.exe terminates all of it's child processes will be left as orphaned and appear at the top level of the process tree. They will not be assigned to another explorer.exe instance and there isn't any way to do that. This isn't a problem. Such applications will continue on as before, usually not even aware that the parent has terminated.

 

[idoru]

Is your computer running any customised shell extensions for Windows Explorer? Or do you have extra items in right-click context menu, that have been added by third-party programs?

Use ShellExView | Nirsoft to see what shell extensions are currently installed on your system. Use this program to temporarily disable shell extensions, and pretty quickly diagnose whether these add-ons are the culprit to your problem.

good thinking, maily because it is already on my computer. I'll do that !

 

[idoru]

When a process such as Explorer.exe terminates all of it's child processes will be left as orphaned and appear at the top level of the process tree. They will not be assigned to another explorer.exe instance and there isn't any way to do that. This isn't a problem. Such applications will continue on as before, usually not even aware that the parent has terminated.

as I'm no coder maybe I'm wrong but it seems to me that being a child process sets up a 'parameter', a state, in that process. so a clean coding should be able to gather such processes and make them child of the new explorer process, right ?

Windows is such a pile of old programming set up alongsilde new additions : nearly 40 years later we still have to restart the computer when beos restarted the system 20 years ago (and linux if I'm not mistaken)

 

[LMiller7]

as I'm no coder maybe I'm wrong but it seems to me that being a child process sets up a 'parameter', a state, in that process. so a clean coding should be able to gather such processes and make them child of the new explorer process, right ?

Windows is such a pile of old programming set up alongsilde new additions : nearly 40 years later we still have to restart the computer when beos restarted the system 20 years ago (and linux if I'm not mistaken)

Certainly Windows could gather up all processes from a terminated parent explorer process and assign them to a new explorer process. Windows does not do this and provides no facility to do so. But would this be a good idea? I don't believe it would. I firmly believe the current behavior is the correct one. And I am a programmer (amateur).

Process Explorer was not designed for the average computer user. It was designed for technical people, often programmers, who understand what they are seeing. The parent of a process is the process that started it. This is not something that can later be changed. Changing the displayed parent of a process would be showing false information. Technical people want to see the truth, not something that has been modified to look nice. Doing so would hide potentially valuable information and raise compatibility and even security issues. There is a lot more here than is immediately apparent.

 

[Alejandro85]

as I'm no coder maybe I'm wrong but it seems to me that being a child process sets up a 'parameter', a state, in that process. so a clean coding should be able to gather such processes and make them child of the new explorer process, right ?

No, Windows doesn't works that way. First of all, the it doesn't provides a way to change a process parent to something else, so it isn't even possible.

Then, yes, there is some flags in each process telling which other process is its parent (all processes are "child" of something else, as every program was started by some other, save for a few boot ones), but changing that if it were possible won't yield any benefit, and in fact, as LMiller said, would convey false information to anyone asking for it. Notepad was started by that particular instance of Explorer, not by this new one.

Changing it would also be a very bad practice for that reason, both for being a false information being returned and also it might develop into security issues, as child and parent processes can under some circumstances share resources. Changing that could enable a privilege escalation.
Besides, it's simply incorrect to change the parent, because pointing to any other Explorer instance would mean that it started Notepad, while in fact was another one.

Which takes to my next point, to what Explorer would we assing it to? There could be none, there could be more than one or there could be another totally unrelated to Windows explorer called "explorer.exe" by pure chance.

And what would be the advantage of doing that? The only "useful" thing would be displaying a nice (and incorrect) process tree in some third-party process manager. Other than informative and sharing a few resources, the parent-child relationship of processes has little to no effects on execution.

In short, current behavior is correct and even desirable. Doing any other thing has negative side-effects in one way or another.

 

[idoru]

I do get your point about parent & child even if changing one of them is, in a coding sense, not different of whaat microsoft is doing since windows 3.1 : adding more and more layers to an antique core, nothing would prevent adding a 'previous state' holding name and reference of the previous parent because it seems to me that dropping at level 0 (system) processes started at level 1 (by explorer) is kinda weakening their environment by allowing them what shouldn't if explorer was still their parent.

Anyway, this is just semantic and rhetorical for a windows so... dusty.

 

[idoru]

by the way, as we are somewhat talking about coding, do you happen to know places in the internet where I could get in touch with coders with some time to spare eventually to talk about a project of mine ?