This tool displays a list of currently running processes on either a local or remote machine.
Syntax
TASKLIST Parameters
Parameter List:
| /S system | Specifies the remote system to connect to. |
| /U domain\user | Specifies the user context under which the command should execute. |
| /P password | Specifies the password for the given user context. Prompts for input if omitted. |
| /M module | Lists all tasks currently using the given exe/dll name. If the module name is not specified all loaded modules are displayed. |
| /SVC | Displays services hosted in each process. |
| /V | Displays verbose task information. |
| /FI filter | Displays a set of tasks that match a given criteria specified by the filter. |
| /FO format | Specifies the output format. Valid values: “TABLE”, “LIST”, “CSV”. |
| /NH | Specifies that the “Column Header” should not be displayed in the output. Valid only for “TABLE” and “CSV” formats. |
Available Filters:
| Filter Name | Valid Operators | Valid Value(s) |
| STATUS | eq, ne | RUNNING |NOT RESPONDING | UNKNOWN |
| IMAGENAME | eq, ne | Image name |
| PID | eq, ne, gt, lt, ge, le | PID value |
| SESSION | eq, ne, gt, lt, ge, le | Session number |
| SESSIONNAME | eq, ne | Session name |
| CPUTIME | eq, ne, gt, lt, ge, le | CPU time in the format of hh:mm:ss. |
| MEMUSAGE | eq, ne, gt, lt, ge, le | Memory usage in KB |
| USERNAME | eq, ne | User name in [domain\]user format |
| SERVICES | eq, ne | Service name |
| WINDOWTITLE | eq, ne | Window title |
| MODULES | eq, ne | DLL name |
NOTE: “WINDOWTITLE” and “STATUS” filters are not supported when querying a remote machine.
Examples:
TASKLIST
TASKLIST /M
TASKLIST /SVC /FO LIST
TASKLIST /S system /FO LIST
TASKLIST /FI “USERNAME ne NT AUTHORITY\SYSTEM” /FI “STATUS eq running”