Make "System" process not modifiable from Task Manager like it is the case in Windows 8

Question

FYI : I have Windows-7 Ultimate Ver 6.1 Service-Pack 1.

There is a tools in the Windows-7 that called Resource Monitor . You can find it in C:\Windows\System32 directory or you also can simply run it via resmon.exe in the Run.

In the list of processes there is a process named System and its PID is equal to 4 always.

If you right-click on it and click on Suspend Process , your computer will hang, your mouse and keyboard will disable, and you have to turn restart your system to getting back to normal state.

In the Windows-8 even if you logged with a Administrator account, you can't suspend this process (System) and when you try to suspend it, you receive Access Denied

Q1: Why Microsoft corporation provide this capability for Administrator to suspend System Process? When we need to suspend it and make or system hang?!

Q2: Is there any way in Windows-7 to config the system so that even Administrator can not suspend this process?

---

If you think there is no way to do that, please read the below :

We can have a list of *.dll files that are related to a process with below command in Command-Prompt :

>tasklist /FI "PID eq Number" /M

And you can have a list of PID numbers in the resmon.exe tool.(You can also use tasklist command in Command-Line windows).

In my system PID of resmon.exe is 1728 (Its process name is perfmon).

Let see a list of .dll files related to resmon.exe :

C:\Windows\system32>tasklist /FI "PID eq 1728" /M

Image Name                     PID Modules
========================= ======== ============================================
perfmon.exe                   1728 ntdll.dll, kernel32.dll, KERNELBASE.dll,
                                   ADVAPI32.dll, msvcrt.dll, sechost.dll,
                                   RPCRT4.dll, GDI32.dll, USER32.dll, LPK.dll,
                                   USP10.dll, ATL.DLL, ole32.dll, SHLWAPI.dll,
                                   SHELL32.dll, OLEAUT32.dll, credui.dll,
                                   Secur32.dll, SSPICLI.DLL, IMM32.DLL,
                                   MSCTF.dll, comctl32.dll, uxtheme.dll,
                                   dwmapi.dll, CRYPTBASE.dll, CLBCatQ.DLL,
                                   wdc.dll, DUser.dll, pdh.dll, pdhui.dll,
                                   COMDLG32.dll, ODBC32.dll, wevtapi.dll,
                                   VERSION.dll, PLA.dll, tdh.dll, NSI.dll,
                                   IPHLPAPI.DLL, WINNSI.DLL, WINSTA.dll,
                                   UTILDLL.dll, SETUPAPI.dll, CFGMGR32.dll,
                                   DEVOBJ.dll, NETAPI32.dll, netutils.dll,
                                   srvcli.dll, wkscli.dll, LOGONCLI.DLL,
                                   BROWCLI.DLL, SAMCLI.DLL, WTSAPI32.dll,
                                   VDMDBG.dll, odbcint.dll, DUI70.dll,
                                   xmllite.dll, OLEACC.dll, FirewallAPI.dll,
                                   profapi.dll, WS2_32.dll, msxml3.dll,
                                   ntmarta.dll, WLDAP32.dll, Perfctrs.dll,
                                   perfdisk.dll, mswsock.dll, DNSAPI.dll,
                                   dhcpcsvc6.DLL, dhcpcsvc.DLL, WINTRUST.dll,
                                   CRYPT32.dll, MSASN1.dll, pcwum.dll,
                                   rasadhlp.dll

C:\Windows\system32>

Note : You have to run Command-Prompt as Administrator

Q3: If I copy the above .dll files from Windows-8 directory and replace Windows-7 .dll files with them, does windows-7 will behave like Windows-8? (Prevent suspending System process)

Note: Assume that we use a live windows CD and a flash memory to Replace dll files. (Normally Windows-7 don't let you to replace .dll files)

Really appreciate your time and consideration :)

Answer 1

Q1: No good reason I can think of; it seems to be an oversight.

Q2: No, because I can do it in my Win8.1 system too. I just did. The Administrators group already does not have the "Suspend/resume process" access right to this process, so how this is working at all, I'm not sure.

Q3: See above. I get the same behavior on Win8.1 so obviously using files from Win8.1 won't help. Also, those DLLs are not likely to be at all happy in the Win8 environment, and are shared by many other programs. You'll break a whole bunch of stuff if you try that.

Sorry..

Answer 2

1. Download and change permissions with Process Explorer.
2. On the process properties view, select the security tab.
3. Press the permissions button.
4. Press the advanced button.
5. If necessary, add yourself or a group you belong to.
6. Edit your permisisons to include "Terminate". (you will need to already have the "Change Permissions" permisison, or you are out of luck.)

OR

It is because the permissions of System (ntoskrnl.exe), are set to "read and write", and are only editable by "Trusted Installer" to prevent noobs from doing damage to their own computer. This includes ending the process itself. You need "Full Control". To fix this simply go to "C:\Windows\System32", right click on "ntoskrnl.exe", and the properties, then click the "security" tab, then go to "Advanced", and then click on "Full Control" for administrator. Now you would be able to end it from Resource Monitor