How to fix ProcExp's irreversible substitution for TaskMgr?

Question

I have a problem with Process Explorer, having fallen into a trap where using "Options > Replace Task Manager" I am unable to reverse that choice. The setting in the menu will not toggle. I am using the current version, but this problem has existed for many years and versions. In browsing the web, many others also have this problem. I have tried the several solutions that have been proposed,[*] but as for most other users the problem persists. That is, running TaskMgr always triggers ProcExp instead.

Can someone here please explain exactly what changes ProcExp makes to the registry so that I can reverse them? The few changes I have seen (tried them all) have had no effect, so there must be other registry changes that common users of ProcExp have not yet discovered.

For this reason I have limped along without Task Manager for many years, but now I desperately need to use one of its features that ProcExp does not have. Surely someone here, hopefully a SysInternals developer, has an answer to my above question?

[*] E.g. removing the "debugger" entry in "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe".

Answer 1

I tried version 16.43 and the current 17.05 on Win 10 and it worked fine.

When launched from an admin command prompt I see a check mark toggle.

As you pointed out, it creates a Debugger value. But I found that twice, once in the 64 bit section and also in the 32 bit section of the registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe

Maybe one is getting deleted and the second one isn't? Remember to hit F5 to refresh if you are looking with regedit.