Forum Discussion
Are child processes "break away" or not by default?
TIMOTHY_MANGAN Thanks!
Yeah, in the meantime I figured out that child process breaks away if the exe image is under AppData (i.e. LocalCache). The child process does NOT break away if the exe image is in VFS. This makes some sense.
So, my "only" remaining problem is that PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_DISABLE_PROCESS_TREE does not appear to work at all with 2004. The process launched with this flag does not "see" the containerized files and registry keys. I need this flag to work so that child processes whose exe image is in AppData will remain in the container. At this point, I don't have any way to force this.
For good measure, I also tried to combine PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_DISABLE_PROCESS_TREE | PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_OVERRIDE but it doesn't help.
The documentation for PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_DISABLE_PROCESS_TREE is "interesting". It doesn't say anything about the "process being created". It only talks about child processes of the process being created. The documentation for PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_OVERRIDE is does talk about the process being created so the combination should definitely work.
This appears to be a bug. Do you know how I can report these?
szilvaa There is a chance that one of the Microsoft Engineers will respond here, but running a test and then entering it using the Feedback Hub on your device would be the way to report this.
I suspect that you will find that this is "by design" now.
An interesting thing to look at is to use Process Explorer (started with RunAsAdmin) and look at the "Jobs" tab. The Container is where Microsoft sets the Breakaway by setting it in the Job of the first process inside the container. This is what changed in 2004. Any breakaway controls placed on the job appear in the lower pane.
TIMOTHY_MANGAN Thanks for your responses! The Jobs tab in process explorer is nice debugging aid!
I have some more news:
I was able to confirm that "Windows October 2020 Update" (aka 10.0.19042.541 ) fixes the change in behavior (I think we can call it "regression" now) in Windows 10 2004 (aka 10.0.19041.508) affecting PROCESS_CREATION_DESKTOP_APP_BREAKAWAY_DISABLE_PROCESS_TREE. This flag works again as documented.
I guess MSIX isn't as mature as I expected it if major parts of the behavior can still regress like this.szilvaa Well yes, MSIX is a work in progress...
And I happened to notice last night that an additional change was made to the PSF by Microsoft over the summer that looks like they are continuing to change things with breakaway. I am unsure exactly what that change allows at present, but it would only be available on builds including the change, and we don't have any real "versions" with the PSF that we can specify to know if you are getting it. I think the change was to allow more flexibility on configuring breakaway, at least on OS versions that allow it.
