Restart Manager Surfaces In Event Monitor

Any time something surfaces in Event Monitor that I’ve never seen before, it always piques my interest. My usual practice is to scan the Event Monitor’s Windows Application and System logs every Monday morning to see what might need my attention. This morning, among the items that caught my eye was this message “Application (pid 4684) cannot be restarted – Application SID does not match Conductor SID” from an unfamiliar source–namely the Restart Manager.

Screencap of Restart Manager warning messge

Warning Message from Restart Manager indicates some problem with restarting an application (click image for fullsize version)

As it turns out, the Restart Manager is a new facility in Windows Vista that is designed to stop and restart applications whenever possible during software installation, with the goal of reducing the number of reboots required following installation of any kind of software–including Windows Update items as well as garden variety apps. This is part of what Windows Installer version 4.0 brings to the Vista party, and is pretty nicely described on the Advanced Installer Web site.

What I found puzzling at first about this message was that it referenced an application I’d installed only briefly, then uninstalled after a single test use. But then it dawned on me that the cause of the message was that Restart Manager obviously had scheduled some kind of clean-up work after the next system restart–one of the many tricks this facility has up its virtual sleeve to limit reboots required to make things run. But by the time it was invoked to handle that task the focus of its cleanup efforts had already vanished from my system.

The language “Application SID does not match Conductor SID”  is opaque, but it turns out it can happen when the installer is run at elevated privilege and the restart runs at user privilege levels, or vice versa. Apparently, it can also happen when the focus of the Restart Manager’s scheduled efforts has gone missing.

I was already sure that it wasn’t too serious, because the message only occurred once, and cleared itself thereafter. The serious stuff just keeps coming back each time the system restarts. But just to be sure, I checked the registry to look for lingering traces of the removed application and nothing turned up. Nevertheless, this gave me an opportunity to learn something new about Vista, which is always welcome here at


Leave a Reply

Your email address will not be published. Required fields are marked *