Tasklist
Applies To: Windows Server 2003, Windows XP, Windows Server 2008, Windows 7, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2000, Windows Server 2012, Windows 8
Displays a list of currently running processes on the local computer or on a remote computer. Tasklist replaces the tlist tool.
For examples of how to use this command, see Examples.
Syntax
tasklist [/s <Computer> [/u [<Domain>\]<UserName> [/p <Password>]]] [{/m <Module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <Filter> [/fi <Filter> [ ... ]]]
Parameters
Parameter |
Description |
|---|---|
/s <Computer> |
Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer. |
/u [<Domain>\]<UserName> |
Runs the command with the account permissions of the user who is specified by UserName or Domain\UserName. /u can be specified only if /s is specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command. |
/p <Password> |
Specifies the password of the user account that is specified in the /u parameter. |
/m <Module> |
Lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task. |
/svc |
Lists all the service information for each process without truncation. Valid when the /fo parameter is set to table. |
/v |
Displays verbose task information in the output. For complete verbose output without truncation, use /v and /svc together. |
/fo {table | list | csv} |
Specifies the format to use for the output. Valid values are table, list, and csv. The default format for output is table. |
/nh |
Suppresses column headers in the output. Valid when the /fo parameter is set to table or csv. |
/fi <Filter> |
Specifies the types of processes to include in or exclude from the query. See the following table for valid filter names, operators, and values. |
/? |
Displays help at the command prompt. |
Filter names, operators, and values
Filter Name |
Valid Operators |
Valid Values |
|---|---|---|
STATUS |
eq, ne |
RUNNING | NOT RESPONDING | UNKNOWN |
IMAGENAME |
eq, ne |
Image name |
PID |
eq, ne, gt, lt, ge, le |
PID value |
SESSION |
eq, ne, gt, lt, ge, le |
Session number |
SESSIONNAME |
eq, ne |
Session name |
CPUTIME |
eq, ne, gt, lt, ge, le |
CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number |
MEMUSAGE |
eq, ne, gt, lt, ge, le |
Memory usage in KB |
USERNAME |
eq, ne |
Any valid user name |
SERVICES |
eq, ne |
Service name |
WINDOWTITLE |
eq, ne |
Window title |
MODULES |
eq, ne |
DLL name |
Remarks
- The WINDOWTITLE and STATUS filters are not supported when a remote system is specified.
Examples
To list all tasks with a process ID greater than 1000, and display them in CSV format, type:
tasklist /v /fi "PID gt 1000" /fo csv
To list the system processes that are currently running, type:
tasklist /fi "USERNAME ne NT AUTHORITY\SYSTEM" /fi "STATUS eq running"
To list detailed information for all processes that are currently running, type:
tasklist /v /fi "STATUS eq running"
To list all the service information for processes on the remote computer "Srvmain" that have a DLL name beginning with "ntdll," type:
tasklist /s srvmain /svc /fi "MODULES eq ntdll*"
To list the processes on the remote computer "Srvmain," using the credentials of your currently logged-on user account, type:
tasklist /s srvmain
To list the processes on the remote computer "Srvmain," using the credentials of the user account Hiropln, type:
tasklist /s srvmain /u maindom\hiropln /p p@ssW23