How Task Manager calculates “Startup Impact” of Apps

If you are a Windows 8 user, you must have observed that the new Task Manager has a Startup tab to manage applications loaded at startup. It includes an interesting "Startup impact" column:

I would like to explain to you what exactly the "startup impact" values mean and how they are calculated for every application.

When you hover your mouse pointer over the column header, Task Manager shows us what that column's values mean via a tooltip:

The exact values of impact on the startup speed of apps are determined and classified as follows:

• High - the application uses more than 1 second (that is, 1000 milliseconds) of CPU time or more than 3MB of disk I/O
• Medium - the application uses 300 to 1000 ms of CPU time or 300KB to 3MB of disk I/O
• Low - the application uses less than 300 milliseconds of CPU time and less than 300KB of disk I/O
• Not Measured - means that the application was not run at startup. Usually, such a value appears for apps which were uninstalled but may still be registered to run at startup. In this example above, I have uninstalled Windows Live Messenger when I switched to Skype.

How Task Manager obtains these values for every app at startup

Under the hood of "Startup Impact" column of Task Manager is WDI - Windows Diagnostics Infrastructure.

At every startup, it tracks startup apps and creates log files in the following location:

C:\Windows\System32\wdi\LogFiles

To access this location, you will first need to open the C:\Windows\System32\wdi location. Explorer will tell you that you don't have access to the folder. Click 'Continue' and it will show you the contents. Then access the 'LogFiles' folder inside it and click 'Continue' again.

The BootCKCL.etl file will be generated at every startup and contains all the data related to app startup. I can open it with "Windows Performance Analyzer" which comes with Visual Studio 2012. If you don't have Visual Studio 2012 installed, you can install Windows Assessment and Deployment Kit (ADK) to get Windows Performance Analyzer.

Using Windows Performance Analyzer, we can see the exact startup performance values in "Details" view:

As shown in the screenshot above, Skype has more than 1 second of CPU time, that is why it is rated with a "startup impact" value of "High".

However, Task Manager in Windows 8 does not use the BootCKCL.etl file directly. There are several XML reports that are generated during startup, based on the BootCKCL.etl file. They are located in the C:\Windows\System32\wdi\LogFiles\StartupInfo folder and named after the Security ID (SID) of the user.

How to get the SID for your user account

You can get the SID with the following command:

wmic useraccount get name,sid

You should open Command Prompt as Administrator (use Win+X hotkey) and then type the command mentioned above. You will get something like this:

There are multiple files for each SID. Open the newest file by looking at their "Date modified" column and for the appropriate SID. You will see the data that Task Manager uses to show you the Startup Impact values. They are quite similar to the data stored in the BootCKCL.etl file.

Now, you know what the "Startup impact" column values exactly mean and you can use it to diagnose which app causes slow startup. Do share with us which are the slowest starting apps on your system (the ones which have "High" impact).

Via Vadim Sterkin