TASKLIST – Windows CMD Command

TaskList displays all running applications and services with their Process ID (PID) This can be run on either a local or a remote computer.

Syntax
      Tasklist options

Options:

   /s computer  Name or IP address of a remote computer.
                Don’t use backslashes. Default = local computer.

   /u domain\user [/p password]]
                Run under a different account.

   /P [password]
                The password for the given user context. Prompts for input if omitted.

   /M [module]
                List all tasks currently using the given exe/dll name.
                If the module name is not specified all loaded modules are displayed.

   /svc         List information for each process without truncation.
                Valid when /fo=TABLE. Cannot be used with /m or /v

   /APPS        Display Store Apps and their associated processes. (Windows 8.1+)

   /V           Verbose task information.

   /FO {TABLE|LIST|CSV}]
                Output format, the default is TABLE.

   /NH          No Headers in the output (does not apply to LIST output)

   /FI FilterName [/FI FilterName2 [ ... ]]
                Apply one of the Filters below:

                   ImageName   eq, ne                  Image Name String
                   PID         eq, ne, gt, lt, ge, le  Process ID, A Positive integer.
                   Session     eq, ne, gt, lt, ge, le  Any valid session number.
                   SessionName eq, ne                  String
                   Status      eq, ne                  RUNNING | NOT RESPONDING | UNKNOWN
                   CPUTime     eq, ne, gt, lt, ge, le  Time hh:mm:ss
                   MemUsage    eq, ne, gt, lt, ge, le  Memory usage in KB, specify a valid integer.
                   Username    eq, ne                  User name ([Domain\]User).
                   Services    eq, ne                  Service Name String
                   Windowtitle eq, ne                  Window Title String
                   Modules     eq, ne                  DLL Name String

Image Name is the name of the process or the executable file running the process, often svchost.exe

Filters must be surrounded with double quotation marks, if a filter string itself includes a double quotation mark, this must be escaped with a backslash \” one exception to this is a double quote at the end, which can be matched using a wildcard: *

if a filter string includes a backslash, that can be escaped with a double backslash \\

Home editions of Windows do not have TASKLIST, use QPROCESS instead.

Examples:

List the services running under each process:

TASKLIST /svc

List the services running under each SvcHost process:

TASKLIST /FI "imagename eq svchost.exe" /svc

List the services running now:

TASKLIST /v /fi "STATUS eq running"

List the services with an ImageName that starts with “C” – notice that a wildcard can only be used at the end of the string:

TASKLIST /FI "IMAGENAME eq c*"

List the services running under a specific user account:

TASKLIST /v /fi "username eq SERVICE_ACCT05"