tasklist
Displays a list of currently running processes on the local computer or on a remote computer. Tasklist replaces the tlist tool.
Note
This command replaces the tlist tool.
Syntax
tasklist [/s <computer> [/u [<domain>\]<username> [/p <password>]]] [{/m <module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <filter> [/fi <filter> [ ... ]]]
Parameters
| Parameter | Description |
|---|---|
/s <computer> |
Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer. |
/u <domain>\<username> |
Runs the command with the account permissions of the user who is specified by <username> or by <domain>\<username>. The /u parameter can be specified only if /s is also specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command. |
/p <password> |
Specifies the password of the user account that is specified in the /u parameter. |
/m <module> |
Lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task. |
| svc | Lists all the service information for each process without truncation. Valid when the /fo parameter is set to table. |
| /v | Displays verbose task information in the output. For complete verbose output without truncation, use /v and /svc together. |
/fo {table | list | csv} |
Specifies the format to use for the output. Valid values are table, list, and csv. The default format for output is table. |
| /nh | Suppresses column headers in the output. Valid when the /fo parameter is set to table or csv. |
/fi <filter> |
Specifies the types of processes to include in or exclude from the query. You can use more than one filter or use the wildcard character (\) to specify all tasks or image names. The valid filters are listed in the Filter names, operators, and values section of this article. |
| /? | Displays help at the command prompt. |
Filter names, operators, and values
| Filter Name | Valid Operators | Valid Value(s) |
|---|---|---|
| STATUS | eq, ne | RUNNING | NOT RESPONDING | UNKNOWN. This filter isn't supported if you specify a remote system. |
| IMAGENAME | eq, ne | Image name |
| PID | eq, ne, gt, lt, ge, le | PID value |
| SESSION | eq, ne, gt, lt, ge, le | Session number |
| SESSIONNAME | eq, ne | Session name |
| CPUtime | eq, ne, gt, lt, ge, le | CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number |
| MEMUSAGE | eq, ne, gt, lt, ge, le | Memory usage in KB |
| USERNAME | eq, ne | Any valid user name (<user> or <domain\user>) |
| SERVICES | eq, ne | Service name |
| WINDOWTITLE | eq, ne | Window title. This filter isn't supported if you specify a remote system. |
| MODULES | eq, ne | DLL name |
Examples
To list all tasks with a process ID greater than 1000, and display them in csv format, type:
tasklist /v /fi "PID gt 1000" /fo csv
To list the system processes that are currently running, type:
tasklist /fi "USERNAME ne NT AUTHORITY\SYSTEM" /fi "STATUS eq running"
To list detailed information for all processes that are currently running, type:
tasklist /v /fi "STATUS eq running"
To list all the service information for processes on the remote computer srvmain, which has a DLL name beginning with ntdll, type:
tasklist /s srvmain /svc /fi "MODULES eq ntdll*"
To list the processes on the remote computer srvmain, using the credentials of your currently logged-on user account, type:
tasklist /s srvmain
To list the processes on the remote computer srvmain, using the credentials of the user account Hiropln, type:
tasklist /s srvmain /u maindom\hiropln /p p@ssW23