tasklist

tasklist

Command: tasklist

Category: Diagnostics

Type: CMD

Purpose

Displays a list of all currently running processes on your Windows system, including process names, Process IDs (PIDs), memory usage, and session information. Essential for monitoring system activity, troubleshooting performance issues, and identifying running applications and services.

Quick Summary

See every running process on your system with one command. Get process names, PIDs, memory consumption, and session details. Perfect for quick system monitoring, identifying resource hogs, finding process IDs for termination, and scripting automation tasks.

How to Use

1. Open Command Prompt or PowerShell (no admin rights required).
2. Type tasklist and press Enter.
3. View the list of all running processes.

Common variations:

tasklist                    - Basic list of all processes
tasklist /v                 - Verbose (detailed) information
tasklist /svc               - Show services hosted in each process
tasklist /m                 - List loaded DLLs/modules
tasklist /fi "STATUS eq running"  - Filter running processes
tasklist > processes.txt    - Save to file

Tips and Best Practices

• Use /v for additional columns like Status, Username, CPU Time, and Window Title.
• Use /svc to see which services are running in svchost.exe processes.
• Filter results with /fi to find specific processes quickly.
• Combine with findstr to search: tasklist | findstr chrome
• Save output for comparison: tasklist > before.txt, make changes, tasklist > after.txt
• Use PID from tasklist with taskkill to terminate processes.
• Check memory usage to identify resource-consuming processes.

Understanding the Output

Basic output columns:

Image Name                   PID Session Name     Session#    Mem Usage
========================= ====== ================ ========== ============
System Idle Process            0 Services                 0         8 K
System                         4 Services                 0     1,234 K
chrome.exe                  5432 Console                  1   234,567 K

Columns explained:

• Image Name: Process/executable name
• PID: Process ID (unique identifier)
• Session Name: Services or Console
• Session#: Session number (0 for services, 1+ for user sessions)
• Mem Usage: Current memory (RAM) consumption

With /v (verbose):

• Status: Running, Not Responding, Unknown
• User Name: Account running the process
• CPU Time: Total processor time used
• Window Title: Title of the main window (for GUI applications)

Common Use Cases

• Process monitoring: Check what's currently running on your system.
• Memory usage analysis: Identify processes consuming excessive memory.
• Finding PIDs: Get Process IDs for use with taskkill or other tools.
• Troubleshooting performance: Identify processes causing slowdowns.
• Service identification: See which services are running (with /svc).
• Malware detection: Spot suspicious or unknown processes.
• Script automation: Use in scripts to check if processes are running.

Prerequisites

• Windows Command Prompt or PowerShell
• No administrator rights required to view processes
• Administrator rights required to see details of all processes (especially system processes)
• Available on Windows XP and later

Using Filters

Filter by image name:

tasklist /fi "imagename eq chrome.exe"

Filter by memory usage (greater than 100 MB):

tasklist /fi "memusage gt 102400"

Filter by status:

tasklist /fi "status eq not responding"

Filter by session:

tasklist /fi "session eq console"

Combine multiple filters:

tasklist /fi "imagename eq svchost.exe" /svc

Common Filter Operators

• eq - equals
• ne - not equal
• gt - greater than
• lt - less than
• ge - greater than or equal
• le - less than or equal

Viewing Services in Processes

See services running in svchost.exe:

tasklist /svc /fi "imagename eq svchost.exe"

Example output:

Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1024 DcomLaunch, PlugPlay, Power
svchost.exe                   1156 RpcEptMapper, RpcSs
svchost.exe                   1284 Audiosrv, Dhcp, eventlog, lmhosts, wscsvc

This helps identify which Windows services are hosted in each svchost.exe instance.

Checking Loaded Modules (DLLs)

List DLLs loaded by a process:

tasklist /m /fi "imagename eq chrome.exe"

List processes using specific DLL:

tasklist /m kernel32.dll

Troubleshooting

• "Access denied" for some processes - Normal for protected system processes; run as Administrator for full details.
• Process not shown - May have exited; refresh the list by running tasklist again.
• Memory values seem wrong - Memory usage is working set (physical RAM); process may use more virtual memory.
• Too many svchost.exe - Normal; Windows groups services into multiple svchost.exe instances for isolation.
• Process shows 0 K memory - Some system processes report minimal memory in task list.

Finding and Killing Processes

Find process PID:

tasklist | findstr notepad

Kill process by PID:

taskkill /PID 1234 /F

Kill process by name:

taskkill /IM notepad.exe /F

Comparing Processes Over Time

Save before:

tasklist > tasklist-before.txt

Save after:

tasklist > tasklist-after.txt

Compare:

fc tasklist-before.txt tasklist-after.txt

Or use PowerShell:

Compare-Object (Get-Content before.txt) (Get-Content after.txt)

Common Process Names

System processes:

• System Idle Process (PID 0): Represents idle CPU time
• System (PID 4): Windows kernel
• smss.exe: Session Manager
• csrss.exe: Client/Server Runtime Subsystem
• svchost.exe: Generic host for Windows services
• lsass.exe: Local Security Authority
• explorer.exe: Windows Explorer (desktop, taskbar, file manager)

Common applications:

• chrome.exe / msedge.exe / firefox.exe: Web browsers
• Teams.exe / slack.exe: Communication apps
• OneDrive.exe: Cloud storage sync

PowerShell Alternative

Get process list:

Get-Process

Detailed process info:

Get-Process | Select-Object ProcessName, Id, CPU, WS

Sort by memory usage:

Get-Process | Sort-Object WS -Descending | Select-Object -First 10

Find specific process:

Get-Process chrome
Get-Process -Name *chrome*

Remote Computer Support

List processes on remote computer:

tasklist /s COMPUTERNAME /u USERNAME /p PASSWORD

Example:

tasklist /s SERVER01 /u DOMAIN\Admin /p MyPassword

Note: Requires admin rights on remote computer and appropriate network access.

Scripting Examples

Check if process is running (batch):

tasklist /fi "imagename eq notepad.exe" 2>NUL | find /I /N "notepad.exe">NUL
if "%ERRORLEVEL%"=="0" echo Process is running

Kill process if running:

tasklist /fi "imagename eq notepad.exe" | find /I "notepad.exe" && taskkill /IM notepad.exe /F

PowerShell - check and start if not running:

if (!(Get-Process notepad -ErrorAction SilentlyContinue)) {
    Start-Process notepad
}

Output Formats

CSV format:

tasklist /fo csv
tasklist /fo csv > processes.csv

Table format (default):

tasklist /fo table

List format:

tasklist /fo list

Related Tools

• taskkill - Terminate processes by PID or name
• taskmgr.exe - Task Manager GUI
• Get-Process (PowerShell) - PowerShell cmdlet for process information
• wmic process - WMI query for process details
• Process Explorer (Sysinternals) - Advanced process viewer
• resmon.exe - Resource Monitor for detailed process monitoring