locked
WHY IS DESKTOP WINDOWS MANAGER -1,-2,-3,-4,-5, OR -6 IN TASK MANAGER IN WINDOWS 8? RRS feed

  • Question

  • With only one user, why does DWM change from DWM-1 to, up to, DWM-6 after shutting down and then restarting my new pc in Windows 8 please?  It stays at DWM-1 if I only restart pc without shutting down.  Is this a Windows 8 fault, or hackers?  There are many established connections in netstat; with Norton IS and NPE, and Comodo CIS finding no malware.

    Also, there were two Winlogon.exe previously, but there is now only one after refreshing and running System File Checker. 

    It's very worrying: I upgraded from Vista for BETTER security!

    Monday, March 25, 2013 4:38 PM

All replies

  • What is your target problém?

    Would you give some more evidence for claiming lower security?

    What does standatd diagnostics tools say?

    Rgds

    Milos

    PS: Perhaps the new edition of Windows Internals would give you more relevant information.

    Tuesday, March 26, 2013 9:39 AM
  • I've seen this yesterday, too on he laptop of my dad. You see several DWM.exe and csrss.exe running in Taskmgr.

    But I have no idea why this is so.


    "A programmer is just a tool which converts caffeine into code"

    Wednesday, March 27, 2013 6:41 AM
    Answerer
  • There is also two winlogon.exe showing in task manager if I shut down and start up again (not on restart); and up to two dozen established connections in netstat; no malware has been reported by antivirus software.  Cairo, Ireland and US are a few of the connections!  Any suggestions on security please?

    Robin.

    Sunday, March 31, 2013 5:11 PM
  • I have the same exact problems.

    I wonder if Microsoft Staff read this.

    I feel that there is security issues with DWM.

    It keep multiplying for no utter reasons.

    I did also 2 winlogon in the tasksbar.

    Is there a backdoor in Windows 8???

    Tuesday, April 9, 2013 9:49 AM
  • I've have formatted my harddisk and I still get the same issues.

    Did Microsoft take note of this issues???

    It seems that I am not the only one.

    Monday, June 10, 2013 12:19 AM
  • I wrote a Microsoft employee an email about it. When I get an answer I'll post the reply here.

    "A programmer is just a tool which converts caffeine into code"

    Monday, June 10, 2013 5:15 AM
    Answerer
  • ok, Gov Maharaj wrote that the number is indeed a session id. So there are other users sessions running.

    "A programmer is just a tool which converts caffeine into code"

    Monday, June 10, 2013 6:55 PM
    Answerer
  • When I query sesssion I only saw one user. 

    How come the DWM, Logui, Winlogin starts to runs multiple times.

    Is there a way to stop this from happening???

    I believe this is a bug in Windows 8. 

    And can cause a security vulnerability issues!

    And I hope Microsoft weeded out the software bugs!

    It occurs both the release version and the enterprise trial version.

    I hope it did not happen when Windows 8.1 comes.

    Monday, June 10, 2013 10:17 PM
  • in taskmanager, open the details tab and activate the session ID column and look what session ids the DWM processes have.

    "A programmer is just a tool which converts caffeine into code"

    Tuesday, June 11, 2013 5:18 AM
    Answerer
  • You mean the Process ID???

    How do I go about doing that?

    Can you help?

    Tuesday, June 11, 2013 6:03 AM
  • You mean the Process ID???


    no, Session ID:


    "A programmer is just a tool which converts caffeine into code"

    Tuesday, June 11, 2013 6:35 PM
    Answerer
  • Okay I'm following....

    Now what next ...


    • Edited by mrdbeta Wednesday, June 12, 2013 12:04 AM
    Tuesday, June 11, 2013 10:11 PM
  • Okay ...

    I load up the screenshot for you to see ... 

    This is what I got. 

    I have DWM2, DWM3, Logonui.EXE and 2 Winlogin.

    Look at the Session ID... 


    • Edited by mrdbeta Wednesday, June 12, 2013 12:02 AM
    Wednesday, June 12, 2013 12:00 AM
  • session 2 and 3 means there are new users logged on to the system. Post a picture of the "Users" tab.


    "A programmer is just a tool which converts caffeine into code"

    Wednesday, June 12, 2013 4:37 AM
    Answerer
  • So how do i go about doing this???

    How to determine that are 2 or 3 users login in to my computer.

    Is there a method which I can disable this?

    Because I do wish to have many users login in to my computer.

    • Edited by mrdbeta Wednesday, June 12, 2013 7:09 AM
    Wednesday, June 12, 2013 7:02 AM
  • go to the Users tab of Taskmgr. What do you see? Are there several users listed?

    "A programmer is just a tool which converts caffeine into code"

    Wednesday, June 12, 2013 5:54 PM
    Answerer
  • No, I only see my own user account.

    There's only 1 User.

    Wednesday, June 12, 2013 10:14 PM
  • please post a screenshot of the users tab.

    "A programmer is just a tool which converts caffeine into code"

    Thursday, June 13, 2013 4:53 AM
    Answerer
  • As you can see it is only 1 User. 

    Is this a software bugs with DWM issues on Windows 8???

    Thursday, June 13, 2013 6:19 AM
  • Hi Andre, 

    It could be a software bug from Windows 8. 

    I'm afraid it can cause security vulnerability.

    Can you please check with Microsoft on this issues. 

    Thank you.

    Thursday, June 13, 2013 11:29 PM
  • Ms told me that software can also create new sessions but I have no idea how to check this. Use the old Clean Boot approach to see which software causes the several user sessions.

    https://support.microsoft.com/kb/929135/en-us


    "A programmer is just a tool which converts caffeine into code"

    Friday, June 14, 2013 4:52 AM
    Answerer
  • Hi

    I think there is no way to disable the DWM in windows 8. 

    Because on Windows 7 you can do so.

    I believe this is a software bug which Microsoft did not know.

    This is my fresh install. And I have formattted my harddisk.

    I did make a comparison with Release version and Trial version.

    Both are the same.

    Can you please forward this message to Microsoft.

    You help is very much appreciated.

    Friday, June 14, 2013 10:11 PM
  • try to clean boot approach until you find the tool which created the issue.

    "A programmer is just a tool which converts caffeine into code"

    Saturday, June 15, 2013 6:54 AM
    Answerer
  • Andre,

    I did a clean format. (zero out the harddisk) and Install Windows 8.

    Still the same thing.

    Maybe this is a known bug that Microsoft did not take off.

    Saturday, June 15, 2013 9:57 PM
  • I don't have it, so it is not a generic issue. I only saw it 2 times at the laptop of my dad.

    Which 3rd party tools do you use?


    "A programmer is just a tool which converts caffeine into code"

    Sunday, June 16, 2013 6:11 AM
    Answerer
  • Andre,

    Regardless of the 3rd Party Tools.

    I did saw the same thing at other laptops.

    I went to the computer store and do a check.

    Same thing!

    Sunday, June 16, 2013 11:47 PM
  • I have no idea. Call the support directly.

    "A programmer is just a tool which converts caffeine into code"

    Monday, June 17, 2013 5:14 AM
    Answerer
  • Hi Andre,

    I appreciate your help.

    At least we try to evaluate this problem.

    I am sure many or some users here have the same issues.

    Monday, June 17, 2013 9:19 PM
  • Did you find any solution to this issue?.. 
    I get locked out of our domain and the only log I can find on my Win 8.1 Ent, is a log that tells me that a user have been locked out due to a logon attempt from a user called "Windows Manager\DWM-2" !?
    • Proposed as answer by jffg12345 Monday, November 4, 2019 1:35 AM
    • Unproposed as answer by jffg12345 Monday, November 4, 2019 1:35 AM
    Tuesday, March 10, 2015 8:42 AM
  • I'm running windows 2012 server which is very similar to Windows 8.1 with lots of extra stuff. I had the exact same problem with unwanted extra session running, and basically just doing nothing while hugging lots of computer resources as it was starting all the regular program like an extra instance of the antivirus, etc., exactly like if another user had logged on the computer, but there was no extra user logged on the machine. As stated above, very suspicious looking. I finally was able to find the culprit after searching for days on end in my spare time looking at the logs, using Progmon by Microsoft Sysinternal which BTW did show the start of the process and when the extra session was starting but not who was starting it, I then try to look for it in Sysinternal Autoruns with again no luck as to who was the culprit. I finally was able to spot the problem by running Microsoft Sysinternal task manager (which BTW Microsoft should install by default on all windows installation) which replace the original windows task manager with a much better one, and I mean a way, way much better one. In it I was able to add a column under the Process Image tab called User Name. In most cases it's the name of the user who started a particular process but it's not checked by default. In my case all the unwanted processes that were under session number 2 were started by the RDV GRAPHICS SERVICE which gave me clues as to who was the culprit. It was the Remote Desktop Virtualization Host that was installed on my server. I can understand the need for it, especially on a virtual server but in my case, I have no idea as to how it became enable and installed. Anyway, uninstalling that thing did clear up that problem on my computer. Just hope it helps you guys. Cheers!
    Monday, November 4, 2019 2:28 AM