XP: Tasklist.exe - Get a List of Processes From the Command Line

Home -> Windows

52849 views

From the computer of: davak (396 recipes)
Created: Sep 13, 2004 Updated: Aug 13, 2008

Add a comment

Add to:

Tasklist.exe is the XP replacement for tlist. From a command prompt it allows you to get a list of active processes from the command line.

Tasklist.exe allows a user to get a running list of tasks/processes on their system. Often this is a nice tool to use if a virus or spyware is keeping you from opening the task manager by CTRL-ALT-DEL.

Update: An alternative method using the Windows Instrumentation command-line interface (WMIC) is also available.

Users of XP home do not have this file by default. You may download it from one of these two sites:

http://www.computerhope.com/download/winxp.htm

http://www.mvps.org/sramesh2k/svchost.htm

Place it in your c:\windows\system32 folder.

Running tasklist:

Start

Run

cmd.exe

tasklist

Common uses and output are...

tasklist

Image Name PID Session Name Session# Mem Usage
================ ======== ============
System Idle Process 0 Console 0 16 K
System 4 Console 0 44 K
smss.exe 660 Console 0 48 K
csrss.exe 724 Console 0 1,352 K
winlogon.exe 748 Console 0 2,132 K
services.exe 792 Console 0 2,096 K
lsass.exe 804 Console 0 1,436 K
svchost.exe 972 Console 0 1,700 K
svchost.exe 1040 Console 0 1,328 K
svchost.exe 1136 Console 0 14,068 K
winampa.exe 1664 Console 0 288 K
...etc

Say I wanted to kill winampa.exe. It's easy... from your command line just type tskill winampa and all your active winampa tasks will be killed. You can see how this would be helpful in killing nasty spyware that prevents you from opening the task manager. Other sample inputs and the help file in included below.

tasklist /m shows the associated active dll files as well.

Image Name PID Modules
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 660 ntdll.dll
csrss.exe 724 ntdll.dll, CSRSRV.dll, basesrv.dll,
winsrv.dll, USER32.dll, KERNEL32.dll,
GDI32.dll, sxs.dll,
RPCRT4.dll, Apphelp.dll, VERSION.dll
winlogon.exe 748 ntdll.dll, kernel32.dll,
RPCRT4.dll, AUTHZ.dll, msvcrt.dll,
CRYPT32.dll, USER32.dll, GDI32.dll,
MSASN1.dll, NDdeApi.dll, PROFMAP.dll,
NETAPI32.dll, USERENV.dll, PSAPI.DLL,
REGAPI.dll, Secur32.dll,
VERSION.dll, WINSTA.dll, WINTRUST.dll
...etc

tasklist /svc shows the active associated services...

Image Name PID Services
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 660 N/A
csrss.exe 724 N/A
winlogon.exe 748 N/A
services.exe 792 Eventlog, PlugPlay
lsass.exe 804 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 972 DcomLaunch, TermService
svchost.exe 1040 RpcSs
...etc

Further details and help can be found by running tasklist /?

TASKLIST [/S system [/U username [/P [password]]]]
[/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
This command line tool displays a list of application(s) and
associated task(s)/process(es) currently running on either local or remote.

Parameter List:
/S system Specifies the remote system to connect to.

/U [domain\]user Specifies the user context under which
the command should execute.

/P [password] Specifies the password for the given
user context. Prompts for input if omitted.

/M [module] Lists all tasks that have DLL modules loaded
in them that match the given pattern name.
If the module name is not specified,
displays all modules loaded by each task.

/SVC Displays services in each process.

/V Specifies that the verbose information
is to be displayed.

/FI filter Displays a set of tasks that match a
given criteria specified by the filter.

/FO format Specifies the output format.
Valid values: "TABLE", "LIST", "CSV".

/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for "TABLE" and "CSV" formats.

/? Displays this help/usage.

Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------
STATUS eq, ne RUNNING | NOT RESPONDING
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name

Examples:
TASKLIST
TASKLIST /M
TASKLIST /V
TASKLIST /SVC
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

See this for further details:
http://www.tech-recipes.com/windows_tips448.html