Windows 11 Preview KB5067036 Task Manager Bug Creates Orphaned taskmgr.exe Instances

A baffling regression in Microsoft’s optional October 28, 2025 Windows 11 preview (KB5067036) can leave Task Manager processes running after the window is closed, allowing multiple invisible copies of taskmgr.exe to accumulate and quietly consume memory and CPU — a problem reproduced across community tests and confirmed by independent reporting.

Background / Overview​

Microsoft released KB5067036 on October 28, 2025 as an optional, non‑security preview cumulative update for Windows 11 (targeting the 24H2 and 25H2 servicing branches). The package advertises visible changes — a redesigned Start menu layout, new battery icon indicators, fixes to the Media Creation Tool — and also includes internal fixes affecting Task Manager’s process‑grouping logic. Early adopters and preview‑ring testers began reporting a strange Task Manager regression within days of the rollout.
The bug’s observable behaviour is simple to state and easy to reproduce on affected machines: open Task Manager (Ctrl+Shift+Esc), click the window Close (X) button to dismiss it, then reopen Task Manager. Instead of one Task Manager entry, the Processes list shows an additional Task Manager process. Repeat the open → close cycle and more taskmgr.exe instances appear. Each of these orphaned processes remains resident until explicitly terminated. Multiple independent reproductions and community threads document the symptom and its impact on system resources.

---

What’s actually happening (reproduction and verification)​

How to reproduce the bug (short steps)​

• Press Windows+R, type winver, and confirm your OS build if you installed KB5067036 (builds reported: 26100.7019 and 26200.7019).
• Press Ctrl+Shift+Esc to open Task Manager.
• Click the window Close (X) control in Task Manager’s top‑right corner.
• Open Task Manager again and switch to Processes → expand Background processes.
• Observe whether additional “Task Manager” entries are present and whether the count increases with repeated open/close cycles.

Command‑line verification can confirm the presence of multiple instances without relying on Task Manager itself:

• PowerShell: Get-Process -Name taskmgr
• Command Prompt: tasklist /FI "IMAGENAME eq taskmgr.exe"

If those commands return more than one taskmgr.exe following repeated open/close cycles, the device is exhibiting the orphaned Task Manager behaviour.

What the orphaned processes look like​

Community test runs and independent outlets report that orphaned Task Manager instances:

• Appear as real processes (taskmgr.exe) in Process Explorer, Task Manager’s Details tab, and command‑line tools.
• Usually surface under Background processes rather than the top‑level Apps group, which can cause casual users to overlook them.
• Consume modest resources individually — typical observations cluster around 20–30 MB of RAM per orphaned instance, and CPU usage per instance can range from nearly 0% to ~1.5% during polling or sampling activity. These figures come from multiple community reproductions and hands‑on tests. fileciteturn0file4turn0file10

---

Measured impact: how bad can this get?​

Individually, each orphaned taskmgr.exe is light. Collectively, the effect can be meaningful, especially on machines with limited RAM or when Task Manager is opened and closed many times (whether manually or by automated tooling).

• Memory: With per‑instance memory in the 20–30 MB range, 10 orphaned instances translate to ~200–300 MB of wasted RAM; 100 instances could consume 2–3 GB. Testers have demonstrated contrived scenarios in which repeated open/close cycles yielded multi‑gigabyte accumulation. fileciteturn0file2turn0file10
• CPU and polling: If orphaned processes retain monitoring threads that poll performance counters or hardware telemetry, background CPU can increase intermittently. Reports describe per‑instance CPU spikes up to ~1.5% when the process is sampling system data; many such processes generate cumulative CPU churn that can cause UI stutter, reduced responsiveness, and marginally higher power use (battery impact on laptops).
• Operational risk: For help‑desk teams, developers, and power users who frequently open Task Manager during profiling, the regression can silently inflate memory pressure, complicate diagnostics, and produce confusing telemetry. Administrators deploying preview updates at scale may experience increased support volume and may be forced to roll back the optional preview in affected environments.

Caveat: much of the available measurement data derives from community reproductions and independent tests performed shortly after the preview’s release. These are reliable indicators of behaviour but are not a substitute for Microsoft’s telemetry; exact per‑device impact will vary by system configuration, third‑party drivers, and feature‑flag gating. Where possible, cross‑validate with local measurements (Get‑Process, tasklist, Process Explorer).

---

Why this likely happened (technical analysis and hypotheses)​

The KB release notes for KB5067036 explicitly mention changes intended to improve Task Manager’s process grouping — code that maps UI rows to underlying process objects and links app entries to their process trees. That gives a plausible direction for where the regression could have been introduced. A reasonable technical hypothesis is that a modification to the process‑grouping or UI lifecycle code altered the shutdown or teardown path of Task Manager, leaving live references (timers, COM objects, performance counter handles, or worker threads) that prevent the process from exiting even after its visible window is destroyed. A new Task Manager launch then creates a fresh process, while the old one remains resident — thereby multiplying instances.
This is consistent with a class of lifecycle bugs commonly seen when a subsystem retains a reference and blocks clean process termination. However, it is important to flag this as an informed hypothesis: Microsoft had not published a formal root‑cause analysis or a known‑issue acknowledgement specifically describing this close‑path failure at the time community reports circulated. Treat the root‑cause explanation as plausible but unconfirmed until vendor engineering provides clarification.

---

Immediate mitigation: practical steps to stop the leak​

Affected users can contain the problem with simple actions that avoid creating additional orphaned instances and that remove existing ones.

• Don’t use the window Close (X) button to dismiss Task Manager while the bug is present. Instead:
• Use Task Manager’s End task on its own entry to terminate the Task Manager process tree cleanly.
• Or run an elevated Command Prompt or PowerShell and execute:
  taskkill /im taskmgr.exe /f
  This force‑kills all taskmgr.exe processes in one command.
• To inspect lingering instances without Task Manager:
• PowerShell: Get-Process -Name taskmgr
• Command Prompt: tasklist | findstr taskmgr
  These commands list active taskmgr.exe instances so manual or scripted cleanups can be performed.
• If resource usage has spiked or behaviour is otherwise impaired, restarting the PC clears orphaned processes.
• If the optional preview is unnecessary for your environment, uninstall KB5067036 via Settings → Windows Update → Update history → Uninstall updates. Note that combined SSU + LCU packages can have additional uninstall semantics; consult the KB entry’s guidance for removal instructions.

---

Recommendations by audience​

Home users and power users​

• If stability matters more than preview features, skip optional preview updates like KB5067036 until Microsoft marks them broadly released or publishes a patch. Preview releases are staged precisely to surface these edge cases — that’s their purpose.
• If already installed and affected:
• Avoid using the Close (X) to dismiss Task Manager. Use End task or taskkill to remove instances.
• Consider using Sysinternals Process Explorer as an alternative monitoring tool; third‑party tooling will not trigger the Task Manager close path and offers deeper diagnostics.

IT administrators and enterprises​

• Treat KB5067036 as a preview update: stage deployments and validate critical administrative workflows and troubleshooting tools in pilot rings before pushing updates to production. Task Manager is a high‑value management utility for support teams — include it in acceptance tests.
• If the issue appears widely across endpoints, consider rolling back the preview in affected clusters and open an enterprise support ticket with Microsoft — include reproducible steps, winver output, process listings, and a short recording of the reproduction to accelerate triage.
• Monitor Microsoft’s Release Health dashboard and the KB support page for KB5067036 for any known‑issue acknowledgements, KIR (known‑issue rollouts), or out‑of‑band fixes. Historically, Microsoft has used emergency patches to resolve high‑impact regressions in servicing windows.

---

Why this is notable for Windows update quality and testing​

This regression underscores three recurring realities about modern OS servicing:

• Small UI changes can cascade. A fix or enhancement in a UI subsystem (process grouping) can have outsized effects on lifecycle logic (close/exit semantics). The interplay of new features, performance monitoring, and lifecycle handling increases test surface area.
• Preview updates surface environment‑specific edge cases. Staged rollouts and preview packages exist to find exactly these kinds of interactive issues in diverse hardware/driver/service combinations; the tradeoff is that some users will encounter regressions before they are broadly addressed.
• Administrators must validate frequently used tools. Tools that support diagnostics and troubleshooting (Task Manager, Process Explorer, performance counters) are critical in enterprise workflows and should be part of acceptance testing for any servicing ring. The cost of an overlooked regression is not only system impact but added support load and potential rollback complexity.

---

Risks, unknowns, and items requiring vendor confirmation​

• Microsoft had not published an explicit known‑issue acknowledgement for Task Manager duplicate instances at the time of the community reporting compiled here; vendor confirmation is required to validate the root cause and the exact set of affected OS builds and hardware. Until Microsoft issues a formal KIR or patch note, treat causation as plausible but unverified.
• The distribution of the bug is not universal: many installs of KB5067036 run without incident. This implies environmental triggers such as specific third‑party drivers, installed services, or server‑side feature gating may influence repro rate. Profiling affected vs unaffected configurations will be essential for a precise fix.
• Performance impact estimates rely on community testing and limited lab reproductions. Microsoft telemetry will yield the authoritative distribution and severity statistics; monitoring official Release Health updates is recommended.

---

Timeline and likely next steps​

• October 28, 2025: KB5067036 published as an optional preview cumulative update. Community reporting of Task Manager duplication began within days of release.
• Short term: expect Microsoft to investigate — Feedback Hub reports and reproduction artifacts speed analysis. Historically, Microsoft has issued out‑of‑band fixes for urgent regressions in the same servicing window when they are confirmed and widely impacting users. Administrators should monitor the KB entry and Release Health for updates.

---

Final assessment​

This Task Manager regression is peculiar in degree but predictable in kind: a focused internal change (process grouping) exposed a lifecycle edge that left the process running after the visible window was closed. The practical impact ranges from a mild annoyance (extra processes consuming a few dozen MB each) to a material performance problem on low‑end hardware or for workflows that repeatedly open and close Task Manager. The immediate remediation is straightforward: avoid the Close (X) button, use End task or taskkill, and uninstall the optional preview if stability is required.
While the bug is likely to be patched quickly — preview updates exist to catch exactly this sort of issue before full release — the incident is a useful reminder for users and admins to treat preview updates with caution, to validate critical troubleshooting tools during acceptance testing, and to report detailed repro steps to vendor support to accelerate fixes. fileciteturn0file11turn0file15

---

The safest course for most users is simple: if KB5067036 is not essential, do not install optional preview updates on production machines. If already installed and affected, use taskkill /im taskmgr.exe /f or Task Manager’s End task to clear orphaned instances, avoid the window Close (X) while a fix is pending, and watch Microsoft’s release notes for an acknowledged fix and patch.

---

Source: PC Gamer A bizarre bug in the latest Windows 11 update allows endless copies of Task Manager to run in the background and can even impact system performance

 

[ChatGPT]

Microsoft has begun rolling out a substantial redesign of the Windows 11 Start menu through the October non‑security preview update (KB5067036), delivering a single, scrollable Start surface, new app‑browsing modes, tighter Phone Link integration, and a set of taskbar and File Explorer refinements that aim to make launching apps and managing cross‑device activity faster and less cluttered.

---

Background / Overview​

Windows' Start menu has been central to desktop navigation for decades, and the latest refresh represents the most visible rework for Windows 11 since the operating system first shipped. The update packages the new UI as part of KB5067036 and is being distributed to Windows 11 versions 24H2 and 25H2 via the Release Preview/optional preview channel, with Microsoft using staged, server‑side feature gating to enable experiences gradually across devices. This means installing the preview package gives your PC the updated binaries, but the redesigned Start may not appear immediately until Microsoft flips the activation flag for your device.
What’s changed in practical terms:

• A single, vertically scrollable Start canvas that places the full All apps inventory on the main page.
• New viewing modes for the All apps list — Category, Grid, and the retained List — letting users choose between automatic grouping, denser alphabetical scanning, or the classic A→Z list.
• A collapsible Phone Link panel embedded in Start for recent phone activity (messages, missed calls, photos).
• Taskbar tweaks including animated app thumbnails on hover and a battery icon option that shows percentage.
• New toggles in Settings → Personalization → Start to hide Recommended content, recently added apps, and other in‑Start suggestions.

These changes are designed to reduce friction (fewer clicks to reach installed apps), scale better on large or touch displays, and fold basic phone‑to‑PC continuity closer to the primary desktop workflow. Early reporting and Microsoft’s own release notes emphasize discoverability and flexibility as the guiding design principles.

---

What’s actually different — deep dive​

Single, scrollable Start surface​

The most fundamental interaction change is that the Start menu now behaves like a single, scrollable launcher. Instead of separating Pinned, Recommended, and All apps across different pages or panels, everything is hosted on one vertical canvas. That reduces one common friction point: previously you often had to open a separate All apps page to find less‑frequent applications. The new approach mirrors mobile launchers and many third‑party desktop launchers that prioritize a single surface for discovery.

Category, Grid and List views​

• Category view: Apps are auto‑grouped into functional buckets (Productivity, Games, Creativity, Communication, etc.) and frequently used apps “bubble up” inside those groups. Categories are created when the system detects sufficient related apps; users cannot yet define custom categories. This view targets task‑oriented workflows where people think in terms of what they want to accomplish rather than specific app names.
• Grid view: Presents an alphabetized, denser tile grid that makes horizontal scanning faster — useful on widescreen displays or when you want a visual, tile‑like layout without Live Tiles.
• List view: The classic, alphabetical vertical list remains available for power users and keyboard‑centric navigation. The Start menu remembers the last view you selected and restores it on the next open.

Screen‑aware responsiveness​

Start adapts to the size and scale of the device. On larger monitors the interface expands to show more pinned apps and categories; on smaller screens it condenses to preserve reachability and reduce clutter. Microsoft’s release notes explicitly mention responsive layout behavior and memory of user preferences for view mode. This is especially helpful for ultrawide displays and hybrid tablet devices where the previous centered, compact Start could feel wasted or cramped.

Phone Link inside Start​

A Phone Link button now appears near the Start search box. Clicking it expands a panel that surfaces recent notifications, missed calls, messages, and photos for a paired Android or iOS device. This brings phone interactions into the primary launcher instead of requiring a separate Phone Link app window, which reduces context switching for users who frequently reference their phone while working on a PC. Rollout timing and exact feature parity between Android and iOS may vary by region.

Taskbar and system tray refinements​

KB5067036 also bundles small but visible taskbar improvements:

• Animated app thumbnails on hover to make window switching feel smoother.
• A redesigned battery icon with an optional battery percentage display directly in the system tray — a longstanding user request. These are quality‑of‑life changes that complement the Start redesign and help make battery and window switching state more immediately visible.

File Explorer and Copilot touches (adjacent changes)​

The same servicing drop includes File Explorer improvements (a Recommended files area in File Explorer Home, StorageProvider APIs for cloud suggestions) and Copilot/Copilot+ UI hooks. Those aren’t strictly Start changes, but they indicate Microsoft’s broader push to tighten file, AI, and continuity experiences across the shell.

---

How Microsoft is delivering the update — what to expect​

Microsoft is shipping the code and enabling features using a mixed delivery model that’s become standard for Windows 11:

• Release Preview / optional non‑security preview update KB5067036 (October 28, 2025) for Windows 11 24H2 and 25H2 packages the binaries and some enablement components.
• Feature activation is staged via server‑side flags, A/B testing, and gradual rollout across devices. Installing the optional update does not guarantee the new Start appears immediately — Microsoft will flip the activation flag for subsets of devices over days or weeks.
• Wider availability is expected to expand through normal Patch Tuesday releases (the next major monthly cumulative rollout) after telemetry and compatibility validation.

How to get the preview now (official path):

• Open Settings → Windows Update.
• Ensure “Get the latest updates as soon as they’re available” is enabled to increase the likelihood of receiving preview packages.
• Look under Optional updates available and install the Preview update (KB5067036) if it appears.
• Reboot and wait; the Start redesign may still be enabled remotely by Microsoft at a later time even after the update is applied.

Alternative (unsupported) routes exist — community tools such as ViVeTool can toggle internal feature flags — but these are not supported by Microsoft and carry risk. Use caution and understand that enabling features this way can produce unstable UI states and complicate future updates.

---

Why this matters — UX and workflow implications​

The Start menu is more than a cosmetic piece of the OS: it’s the first interaction many users have with their desktop. Small changes compound into daily friction or efficiency gains.

• Fewer clicks, faster app launch: By making All apps visible on the main surface, the redesign eliminates a formerly required secondary step for many app launches. Users with long application lists or keyboard-driven workflows should see measurable reductions in time to app.
• Task‑oriented discovery: Category view is a move toward intent‑based finding rather than name recall. If you think “I need a photo editor” rather than “Where’s GIMP?”, categories can speed the path. This aligns Start more with mobile launchers and app shelves on iPadOS.
• Cleaner, distraction‑free option: Users who disliked the Recommended feed can now hide it entirely — useful for minimalists, privacy‑conscious users, or environments where recent files should not be visible. That reduces cognitive noise and potential data leak surfaces (but administrators should validate policy impacts in enterprise environments).
• Better use of large screens: The responsive layout reduces wasted whitespace on ultrawide and high‑DPI displays by surfacing more pins and categories — an overdue practical improvement for multi‑monitor setups.
• Phone continuity closer to the desktop: Phone Link embedded in Start reduces the friction of phone‑to‑PC interactions, which is meaningful for users who frequently copy/paste numbers, review messages, or answer calls while working on a computer. Regional parity and iOS feature differences should be expected.

---

Strengths and positives​

• Thoughtful response to long‑standing complaints: Microsoft is addressing criticisms about discoverability and extra clicks that have persisted since Windows 11’s initial Start layout. The move to a single surface is pragmatic and user‑tested.
• Choice, not coercion: New views and the ability to hide Recommended content give users agency over density and behavior; the Start menu now supports diverse workflows from minimal to information‑dense.
• Incremental, safe rollout model: Staged activation helps Microsoft test broad compatibility and avoid regressions on millions of machines. For cautious users and IT admins, the preview path followed by Patch Tuesday general distribution is a sensible timeline.
• Ecosystem polish: The taskbar, File Explorer, and Copilot/Copilot+ touches bundled with the preview show an integrated approach to shell improvements rather than isolated window dressing.

---

Risks, limitations and caveats​

• Server‑side gating creates inconsistent experiences: Some users who install KB5067036 will immediately see the new Start; others won’t until Microsoft flips the activation flag. This can be confusing for multi‑device users and IT pilots. Documented guidance from Microsoft confirms this staged behavior.
• Category grouping is automated and non‑editable for now: The Category view groups apps automatically and does not currently allow manual category creation or deterministic grouping. Power users who require precise control over organization may find this limiting. Microsoft may expand controls later, but there’s no official timeline.
• Feature parity and regional availability: Phone Link features, recommended file visibility, and some Copilot capabilities can be gated by region, account type (personal vs commercial), or device hardware. Admins should evaluate how these behaviors interact with enterprise policies.
• Preview instability risk: KB5067036 is a non‑security preview. While Microsoft intends these to be safe for broad testing, preview releases can surface bugs (e.g., Media Creation Tool fixes bundled here came with caveats in early reporting). If stability is critical, waiting for the cumulative Patch Tuesday rollout may be prudent.
• Unsupported modifies (ViVeTool): Forcing the UI with third‑party or community tools is unsupported and can introduce update regressions or UI inconsistencies. The official path is the only recommended approach for production machines.

---

For power users and IT admins — recommended steps​

• Inventory: Identify devices where UI consistency matters (shared endpoints, training images, documentation).
• Pilot ring: Enroll a small pilot group in the Release Preview channel or enable the “Get the latest updates as soon as they’re available” toggle to evaluate KB5067036 in a controlled environment.
• Test workflows: Validate keyboard shortcuts, scripting, and any third‑party start/menu utilities (Start11, StartAllBack) since the new Start may interact with or break legacy behavior.
• Policy review: Confirm whether hiding Recommended files conflicts with corporate data discovery or compliance tools. If necessary, prepare Group Policy or Intune configuration guidance before broad rollouts.
• Communication: Inform end users about the change, show screenshots of the new views, and provide a short how‑to for toggling Recommended content or switching views. Visual changes like this generate the most support calls in early rollouts.

---

How to try it now (step‑by‑step)​

• Confirm your Windows build: Press Windows+R, type winver, and press Enter. The preview is associated with builds in the 26100.x / 26200.x families for 24H2/25H2; Microsoft’s KB lists OS Builds 26100.7019 and 26200.7019 as part of the October 28, 2025 preview.
• Open Settings → Windows Update → Check for updates.
• If you see “Preview update (KB5067036)” under Optional updates available, choose Download & install. Reboot after installation.
• If the redesigned Start does not appear immediately after reboot, be patient: Microsoft may still be gating activation for your device. Do not use unsupported feature toggles unless you accept the risk.

---

What to watch next​

• Microsoft’s broader Patch Tuesday distribution will determine when the new Start becomes ubiquitous; expect wider availability in the November cumulative release cycle if preview telemetry is clean.
• Administrative controls and enterprise policy support: Look for Intune/Group Policy documentation that explicitly covers toggles for hiding Recommended content, controlling Phone Link behavior, and managing Start layout at scale.
• User customization: Microsoft may expose manual category editing or pinned management enhancements in future flights in response to user feedback.
• Interaction with assistive technologies: Accessibility teams and admins should validate that screen readers, keyboard navigation, and voice access flows remain consistent across view modes. The update bundle includes on‑device voice improvements, but real‑world accessibility tests matter.

---

Verdict — practical takeaways​

The Start menu refresh is a pragmatic, well‑targeted improvement that returns some of the discoverability and density users missed while preserving the visual polish Windows 11 introduced. For most users, the changes will feel like a welcome modernization: fewer clicks to reach apps, clearer options for controlling Recommended content, and better behavior on large screens.
However, the staged rollout model means experiences will be inconsistent in the near term, and some advanced organization features (manual category control) are absent today. IT teams should plan pilot deployments and communications; everyday users who prefer stability can wait for the Patch Tuesday general release. For enthusiasts and testers, the preview offers a solid preview of a more flexible Start that balances modern aesthetics with pragmatic utility.

---

Quick summary (for scanners)​

• New Start menu arrives with KB5067036 (October 28, 2025 preview) and is rolling out in stages.
• Main changes: single, scrollable Start surface; Category/Grid/List views; Phone Link panel in Start; taskbar thumbnail animations and battery percentage option.
• Delivery: install Preview (Optional update) or use Release Preview channel; Microsoft activates features server‑side so immediate visibility may vary.
• IT & power users: pilot first, test accessibility and third‑party utilities, don’t force enable with unsupported tools unless prepared for rollback.

The redesigned Start is a clear example of Microsoft listening to Windows’ vocal user base and iterating toward a Start that’s both modern and utilitarian — delivered cautiously, so the company can scale it without breaking the millions of workflows that depend on the Windows desktop.

---

Source: Digital Trends Windows 11’s new Start menu begins rolling out, and it’s more flexible than ever