Windows 10 Issue with procmon

P

PaulSp

Member
Joined
Jul 14, 2019
Messages
39
I recently downloaded the procmon tool. I've noticed that after stopping it a subsequent attempt to run a privileged program gets an error dialog saying that a system monitor is running and to remove it. This prevents the privileged program execution. Rebooting cures the problem. The two times that I've run procmon, this has happened. Has anyone else seen this behavior?
 
Solution
P
Ok. Another data point. I tried running a different program requesting privilege and didn't get the error dialog. So there must be something about the program itself (PokerTracker) that is generating this error. So unless you play poker, you're not likely to encounter this, I suspect. I will report this to the PokerTracker developers and see what they say.
Sort by date Sort by votes
Clearly some remnant of procmon has remained after its termination, else I wouldn't get the error that I did.
 
Upvote 0 Downvote
I will experiment a little further. It has occurred to me that perhaps I clicked the "X" to close it rather than using its "exit" function. This could possibly result in procmon not cleaning up as it should. I will post results after I try this.
 
Upvote 0 Downvote
Exit and clicking the x have the same result. Procmon consists of a single process and a driver both unload when procmon is closed.
 
Upvote 0 Downvote
Ok, I ran procmon and then performed a File-> Exit. Then when I tried to run a privileged program I got the attached error.
 

Attachments

  • errordiaglog.webp
    7.6 KB · Views: 123
Upvote 0 Downvote
Ok. Another data point. I tried running a different program requesting privilege and didn't get the error dialog. So there must be something about the program itself (PokerTracker) that is generating this error. So unless you play poker, you're not likely to encounter this, I suspect. I will report this to the PokerTracker developers and see what they say.
 
Upvote 0 Downvote
Solution
Searching the internet has provided other users with similar problems. According to some reports, these tools load a "kernel mode driver" which remains after the program (in this case procmon) exits. WinLicense is apparently a tool used by some developers to manage their software distributions. It apparently detects this driver somehow. I'm not sure who should fix this.
 
Upvote 0 Downvote
Yes. The PokerTracker folks say that it was done on purpose for "security" reasons. I fail to see what I could obtain from PokerTracker using procmon that would be a security problem.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

  • Featured
  • Article Article
Windows 11 24H2 Update Preview: Task Manager Issue with Zero Process Count
Replies
0
Views
72
ChatGPT
  • Featured
  • Article Article
Windows Server 2025 Update Fiasco: Glitch or Major Upgrade Issue?
Replies
0
Views
89
ChatGPT
  • Featured
  • Article Article
Windows 11 24H2 Update: Tackling the 8.63GB Undeletable Cache Issue
Replies
0
Views
132
ChatGPT
  • Featured
  • Article Article
Outlook Freezing Issue for Microsoft 365 Users: Temporary Fixes and Solutions
Replies
0
Views
94
ChatGPT
  • Featured
  • Article Article
Task Manager Glitch in Windows 11: Microsoft Acknowledges Reporting Issue
Replies
0
Views
68
ChatGPT