Disallowed processes: delay in terminating?

Started by Autumner, August 14, 2017, 10:22:32 AM

Previous topic - Next topic

Autumner

I could be wrong here, but starting somewhere from a recent update, I am noticing at PC startup that while ProcessGovernor.exe runs early as always, it is noticeably slower to shut down disallowed processes. They will stay active and running for about half a minute (a bit less, actually) and only then will they be closed automatically.

I seem to remember that disallowed processes were shut down almost instantly at startup. PL Pro 9.0.0.394 x64, W10 Pro.

edkiefer

Hi, can you post the process, I assume its starting at startup, also is this a OS process.
Bitsum QA Engineer

Autumner

Thanks, I'm disallowing searchui.exe (the infamous Cortana, but I'll probably allow it back because killing it entirely I think causes issues) and benefitspopup.exe, which is part of Diskeeper and quite unnecessary to have in the background.

edkiefer

#3
When it comes to OS processes, some maybe be better to disable other ways as OS is so integrated.
There are a few app out that can tweak/disable Cortana that probably would do better.

Off top of my head ,Shutup10, Win10Privacy , I think using these types app maybe be safer way, while I have not checked if that process (searchui.exe) gets stopped as I really don't worry.
There also a reg fix, but i can't not comment on it's working.

Disable Cortana
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search]
“AllowCortana”=dword:00000000

I think I have my system not have location or online searching disabled for search and Cortana.

On the delay, how much time are we talking (you can check by looking at creation time column and testing with and w/o disallow)?
If you have all logging options enabled, it will show in logs to.

Edit: I ran a few tests, disallowprocess seems to be working fine here, but again the OS might try to restart it depending on the process.
Bitsum QA Engineer

Jeremy Collake

A *minute*? Something is very wrong here if the delay is that long. We need to evaluate this closer. Something does not sound right at all.

A restart of the offending process could indeed cause this illusion, but in no case should Process Lasso ever be delayed a minute unless it's governor is not running (or entirely stopped/stalled).

I would suggest trials on other processes... and I did skim, apologies, please add as needed to bring me up to date.
Software Engineer. Bitsum LLC.

edkiefer

First you need to unhide it as, as soon as I started VM , it went suspended.
When I did disallow searchui.exe, 5-6 new ones or I saw terminations in log right away with each new ID#.
So depending on how you set up OS, this one is a problem if you do it.

Rebooting shows it only took few sec to terminate first one, but I see 5 more instances of it within a min of running.
It does seem to calm down a bit after a min or two, but I wouldn't do it personally.
Bitsum QA Engineer

Jeremy Collake

Yea, it must be restarting itself and you seeing the 'in-between' intervals. Cortana is notoriously difficult to kill ;).
Software Engineer. Bitsum LLC.