There are NT, Windows 2000 and Windows XP compatible commandline utilities to
list and kill active tasks and processes. Windows NT Server Resource Kit
includes tlist.exe which lists active tasks and
processes. To see the usage statement, at the command-line, type
tlist /?
You will get:
Microsoft (R) Windows NT (TM) Version 5.1 TLIST Copyright (C) Microsoft Corp. 1981-1999
usage: TLIST <<-m > | <-t> | | | <-p >>
[options]:
-t
Print Task Tree
List module information for this task.
The pattern can be a complete task
name or a regular expression pattern
to use as a match. Tlist matches the
supplied pattern against the task names
and the window titles.
-m Lists all tasks that have DLL modules loaded
in them that match the given pattern name
-s
Show services active in each process.
-p Returns the PID of the process specified or -1
if the specified process doesn’t exist. If there
are multiple instances of the process running only
the instance with the first PID value is returned.
The utility pulist.exe performs the same function but
adds information about the owner of the tasks. tlist is
a console only task whereas pulist can be executed
remotely. The usage statement for pulist follows:
PULIST for Windows NT v1.00 Dec 21 1999 07:44:32
(c) Copyright 1996 Scott Field and Microsoft Corp.
This utility displays all the processes running on a system.
If no server name is specified, this utility will attempt to display
the username associated with each process running on the local system.
Usage: pulist [\\Server] [\\Server…]
Both utilities are Windows 2000
compatible.
Microsoft has replaced tlist.exe with tasklist.exe in Windows XP.
TASKLIST [/S system [/U username [/P [password]]]]
[/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]
Description:
This command line tool displays a list of application(s) and
associated task(s)/process(es) currently running on either a local or
remote system.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which
the command should execute.
/P [password] Specifies the password for the given
user context. Prompts for input if omitted.
/M [module] Lists all tasks that have DLL modules loaded
in them that match the given pattern name.
If the module name is not specified,
displays all modules loaded by each task.
/SVC Displays services in each process.
/V Specifies that the verbose information
is to be displayed.
/FI filter Displays a set of tasks that match a
given criteria specified by the filter.
/FO format Specifies the output format.
Valid values: “TABLE”, “LIST”, “CSV”.
/NH Specifies that the “Column Header” should
not be displayed in the output.
Valid only for “TABLE” and “CSV” formats.
/? Displays this help/usage.
Filters:
Filter Name Valid Operators Valid Value(s)
———– ————— ————–
STATUS eq, ne RUNNING | NOT RESPONDING
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh – hours,
mm – minutes, ss – seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name
Examples:
TASKLIST
TASKLIST /M
TASKLIST /V
TASKLIST /SVC
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI “USERNAME ne NT AUTHORITY\SYSTEM” /FI “STATUS eq running”
An example from my PC:
E:\Documents and Settings\Wayne>tasklist /svc
Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 484 N/A
csrss.exe 540 N/A
winlogon.exe 572 N/A
services.exe 616 Eventlog, PlugPlay
lsass.exe 628 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 824 RpcSs
svchost.exe 876 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
Iprip, lanmanserver, lanmanworkstation,
Messenger, Netman, Nla, RasMan, Schedule,
seclogon, SENS, ShellHWDetection, srservice,
TapiSrv, TermService, Themes, TrkWks,
uploadmgr, W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe 988 Dnscache
svchost.exe 1052 LmHosts, RemoteRegistry, SSDPSRV, WebClient
explorer.exe 1280 N/A
spoolsv.exe 1328 Spooler
Directcd.exe 1464 N/A
qttask.exe 1528 N/A
mm_tray.exe 1536 N/A
HotTray.exe 1744 N/A
Dllcmd32.exe 1772 N/A
nvsvc32.exe 1972 NVSvc
tcpsvcs.exe 176 SimpTcp
Tmntsrv.exe 3308 Tmntsrv
PCCPFW.exe 3040 PCCPFW
PCCClient.exe 3264 N/A
pccguide.exe 3520 N/A
WebTrap.exe 3540 N/A
Pop3trap.exe 3480 N/A
realsched.exe 1416 N/A
OUTLOOK.EXE 2968 N/A
msmsgs.exe 3388 N/A
WINWORD.EXE 1788 N/A
iexplore.exe 1700 N/A
cmd.exe 2796 N/A
UEDIT32.EXE 1760 N/A
wmiprvse.exe 3840 N/A
tasklist.exe 3672 N/A
Windows XP also added commandline utility taskkill to kill processes by process id
or image name. NT Resource Kit Server
