Warning: Invalid argument supplied for foreach() in /home/techrecipes/public_html/wp-content/themes/techrecipes/header.php on line 77

XP: Tasklist.exe – Get a List of Processes From the Command Line

   Posted by David Kirk in Windows

Tasklist.exe is the XP replacement for tlist. From a command prompt it allows you to get a list of active processes from the command line.


Tasklist.exe allows a user to get a running list of tasks/processes on their system. Often this is a nice tool to use if a virus or spyware is keeping you from opening the task manager by CTRL-ALT-DEL.

Update: An alternative method using the Windows Instrumentation command-line interface (WMIC) is also available.

Users of XP home do not have this file by default. You may download it from one of these two sites:

Place it in your c:\windows\system32 folder.

Running tasklist:

    1. Click Start
    2. Click Run
    3. Enter cmd.exe in the textbox and click OK
    4. Type tasklist with additional arguments in the command window

Common uses and output are…

tasklist
Image Name PID Session Name Session# Mem Usage
================ ======== ============
System Idle Process 0 Console 0 16 K
System 4 Console 0 44 K
smss.exe 660 Console 0 48 K
csrss.exe 724 Console 0 1,352 K
winlogon.exe 748 Console 0 2,132 K
services.exe 792 Console 0 2,096 K
lsass.exe 804 Console 0 1,436 K
svchost.exe 972 Console 0 1,700 K
svchost.exe 1040 Console 0 1,328 K
svchost.exe 1136 Console 0 14,068 K
winampa.exe 1664 Console 0 288 K
...etc

Say I wanted to kill winampa.exe. It’s easy… from your command line just type tskill winampa and all your active winampa tasks will be killed. You can see how this would be helpful in killing nasty spyware that prevents you from opening the task manager. Other sample inputs and the help file in included below.

tasklist /m shows the associated active dll files as well.
Image Name PID Modules
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 660 ntdll.dll
csrss.exe 724 ntdll.dll, CSRSRV.dll, basesrv.dll,
winsrv.dll, USER32.dll, KERNEL32.dll,
GDI32.dll, sxs.dll,
RPCRT4.dll, Apphelp.dll, VERSION.dll
winlogon.exe 748 ntdll.dll, kernel32.dll,
RPCRT4.dll, AUTHZ.dll, msvcrt.dll,
CRYPT32.dll, USER32.dll, GDI32.dll,
MSASN1.dll, NDdeApi.dll, PROFMAP.dll,
NETAPI32.dll, USERENV.dll, PSAPI.DLL,
REGAPI.dll, Secur32.dll,
VERSION.dll, WINSTA.dll, WINTRUST.dll
...etc

tasklist /svc shows the active associated services…
Image Name PID Services
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 660 N/A
csrss.exe 724 N/A
winlogon.exe 748 N/A
services.exe 792 Eventlog, PlugPlay
lsass.exe 804 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 972 DcomLaunch, TermService
svchost.exe 1040 RpcSs
...etc

Further details and help can be found by running tasklist /?

TASKLIST [/S system [/U username [/P [password]]]]
[/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
This command line tool displays a list of application(s) and
associated task(s)/process(es) currently running on either local or remote.

Parameter List:
/S system Specifies the remote system to connect to.

/U [domain\]user Specifies the user context under which
the command should execute.

/P [password] Specifies the password for the given
user context. Prompts for input if omitted.

/M [module] Lists all tasks that have DLL modules loaded
in them that match the given pattern name.
If the module name is not specified,
displays all modules loaded by each task.

/SVC Displays services in each process.

/V Specifies that the verbose information
is to be displayed.

/FI filter Displays a set of tasks that match a
given criteria specified by the filter.

/FO format Specifies the output format.
Valid values: "TABLE", "LIST", "CSV".

/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for "TABLE" and "CSV" formats.

/? Displays this help/usage.

Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------
STATUS eq, ne RUNNING | NOT RESPONDING
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name

Examples:
TASKLIST
TASKLIST /M
TASKLIST /V
TASKLIST /SVC
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

See this for further details:
http://www.tech-recipes.com/rx/448/xp_pro_vista_tasklist

 

About David Kirk

David Kirk is one of the original founders of tech-recipes and is currently serving as editor-in-chief. Not only has he been crafting tutorials for over ten years, but in his other life he also enjoys taking care of critically ill patients as an ICU physician.
View more articles by David Kirk

The Conversation

Follow the reactions below and share your own thoughts.

  • Tony

    why does tasklist fail to connect to a network computer? knowing that I give it the username and password to access that computer.

  • Thyag

    I understand that tasklist displays only the image(process) exe name.
    Is there a way to display the Application name of the active user applications which are currently running (the programs which we could see on the taskbar)?

    • The Stig

      well its possible to display the WindowTitle, wich at least in some cases are the “application name”. Otherwise its probably WMI, or powershell thats needed.