Image file execution options (or how to replace taskmgr.exe)

Well, tricked out with the new procexp.exe, I wondered how it did it’s magic ‘replace the task manager’ option. It turns out that this magic is from the Image File Execution Options registry key entries. There’s a blog entry which describes this feature. process explorer sets itself up as the debugger application for taskmgr.exe, when you try to launch taskmgr, it launches procexp first as it’s debugger, which then doesn’t launch taskmgr.