How Task Manager calculates “Startup Impact” of Apps

If you are a Windows 8 user, you must have observed that the new Task Manager has a Startup tab to manage applications loaded at startup. It includes an interesting "Startup impact" column:

Task Manager in WIndows 8

I would like to explain to you what exactly the "startup impact" values mean and how they are calculated for every application.

When you hover your mouse pointer over the column header, Task Manager shows us what that column's values mean via a tooltip:

Startup Impact

The exact values of impact on the startup speed of apps are determined and classified as follows:

  • High - the application uses more than 1 second (that is, 1000 milliseconds) of CPU time or more than 3MB of disk I/O
  • Medium - the application uses 300 to 1000 ms of CPU time or 300KB to 3MB of disk I/O
  • Low - the application uses less than 300 milliseconds of CPU time and less than 300KB of disk I/O
  • Not Measured - means that the application was not run at startup. Usually, such a value appears for apps which were uninstalled but may still be registered to run at startup. In this example above, I have uninstalled Windows Live Messenger when I switched to Skype.

How Task Manager obtains these values for every app at startup

Under the hood of "Startup Impact" column of Task Manager is WDI - Windows Diagnostics Infrastructure.

At every startup, it tracks startup apps and creates log files in the following location:

C:\Windows\System32\wdi\LogFiles

To access this location, you will first need to open the C:\Windows\System32\wdi location. Explorer will tell you that you don't have access to the folder. Click 'Continue' and it will show you the contents. Then access the 'LogFiles' folder inside it and click 'Continue' again.

WDI Logs

The BootCKCL.etl file will be generated at every startup and contains all the data related to app startup. I can open it with "Windows Performance Analyzer" which comes with Visual Studio 2012. If you don't have Visual Studio 2012 installed, you can install Windows Assessment and Deployment Kit (ADK) to get Windows Performance Analyzer.

Using Windows Performance Analyzer, we can see the exact startup performance values in "Details" view:

Windows Perfomance Analyzer

Perfomance Analyzer

As shown in the screenshot above, Skype has more than 1 second of CPU time, that is why it is rated with a "startup impact" value of "High".

However, Task Manager in Windows 8 does not use the BootCKCL.etl file directly. There are several XML reports that are generated during startup, based on the BootCKCL.etl file. They are located in the C:\Windows\System32\wdi\LogFiles\StartupInfo folder and named after the Security ID (SID) of the user.

How to get the SID for your user account

You can get the SID with the following command:

wmic useraccount get name,sid

You should open Command Prompt as Administrator (use Win+X hotkey) and then type the command mentioned above. You will get something like this:

Get SID for your user account

There are multiple files for each SID. Open the newest file by looking at their "Date modified" column and for the appropriate SID. You will see the data that Task Manager uses to show you the Startup Impact values. They are quite similar to the data stored in the BootCKCL.etl file.

Perfomance Report

Now, you know what the "Startup impact" column values exactly mean and you can use it to diagnose which app causes slow startup. Do share with us which are the slowest starting apps on your system (the ones which have "High" impact).

Via Vadim Sterkin

5 thoughts on “How Task Manager calculates “Startup Impact” of Apps

  1. YM

    How Windows 8 task manager REALLY calculates startup impact of apps:
    1) Windows 8 logs a bunch of information about applications on every startup.
    2) Windows 8 then disregards all of this information.
    3) Windows 8 task manager displays “Not measured” for every app in the startup tab.

    Well-loved. Like or Dislike: Thumb up 7 Thumb down 0

    Reply
    1. Sergey Tkachenko Post author

      Very nice and clever comment, mate…

      Like or Dislike: Thumb up 1 Thumb down 0

      Reply
      1. Jen-ElderOfTheInternet

        He’s right, though… I think it’s a permissions error because I had to ‘allow’ myself access to that WDI folder before I could look at it. My clean install of W8 is going through some very strange behaviour.

        Like or Dislike: Thumb up 2 Thumb down 0

        Reply
  2. jon

    3MB of disk I/O? What is this, 1970?

    Like or Dislike: Thumb up 0 Thumb down 0

    Reply
    1. Sergey Tkachenko Post author

      It is Microsoft :)

      Like or Dislike: Thumb up 0 Thumb down 0

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *