Tlist / tasklist / PUlist lists active tasks and processes

by Wayne Maples [Published on 20 April 2004 / Last Updated on 20 April 2004]

There are NT, Windows 2000 and Windows XP compatible commandline utilities to list and kill active tasks and processes. Windows NT Server Resource Kit includes tlist.exe which lists active tasks and processes. To see the usage statement, at the command-line, type

tlist /?

You will get:

Microsoft (R) Windows NT (TM) Version 5.1 TLIST
Copyright (C) Microsoft Corp. 1981-1999

usage: TLIST <<-m > | <-t> |  |  | <-p >>
           [options]:
           -t
              Print Task Tree

           
              List module information for this task.

           
              The pattern can be a complete task
              name or a regular expression pattern
              to use as a match.  Tlist matches the
              supplied pattern against the task names
              and the window titles.

           -m 
              Lists all tasks that have DLL modules loaded
              in them that match the given pattern name

           -s
              Show services active in each process.

           -p 
              Returns the PID of the process specified or -1
              if the specified process doesn't exist.  If there
              are multiple instances of the process running only
              the instance with the first PID value is returned.

The utility pulist.exe performs the same function but adds information about the owner of the tasks. tlist is a console only task whereas pulist can be executed remotely. The usage statement for pulist follows:


PULIST for Windows NT v1.00 Dec 21 1999 07:44:32
(c) Copyright 1996 Scott Field and Microsoft Corp.
 This utility displays all the processes running on a system. 
 If no server name is specified, this utility will attempt to display
 the username associated with each process running on the local system.

Usage: pulist [\\Server] [\\Server...]

Both utilities are Windows 2000 compatible.

Microsoft has replaced tlist.exe with tasklist.exe in Windows XP.

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
    This command line tool displays a list of application(s) and
    associated task(s)/process(es) currently running on either a local or
    remote system.

Parameter List:
   /S     system           Specifies the remote system to connect to.

   /U     [domain\]user    Specifies the user context under which
                           the command should execute.

   /P     [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

   /M     [module]         Lists all tasks that have DLL modules loaded
                           in them that match the given pattern name.
                           If the module name is not specified,
                           displays all modules loaded by each task.

   /SVC                    Displays services in each process.

   /V                      Specifies that the verbose information
                           is to be displayed.

   /FI    filter           Displays a set of tasks that match a
                           given criteria specified by the filter.

   /FO    format           Specifies the output format.
                           Valid values: "TABLE", "LIST", "CSV".

   /NH                     Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.

   /?                      Displays this help/usage.

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------
    STATUS          eq, ne                    RUNNING | NOT RESPONDING
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

Examples:
    TASKLIST
    TASKLIST /M
    TASKLIST /V
    TASKLIST /SVC
    TASKLIST /M wbem*
    TASKLIST /S system /FO LIST
    TASKLIST /S system /U domain\username /FO CSV /NH
    TASKLIST /S system /U username /P password /FO TABLE /NH
    TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

An example from my PC:

E:\Documents and Settings\Wayne>tasklist /svc

Image Name                   PID Services
========================= ====== =============================================
System Idle Process            0 N/A
System                         4 N/A
smss.exe                     484 N/A
csrss.exe                    540 N/A
winlogon.exe                 572 N/A
services.exe                 616 Eventlog, PlugPlay
lsass.exe                    628 PolicyAgent, ProtectedStorage, SamSs
svchost.exe                  824 RpcSs
svchost.exe                  876 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 ERSvc, EventSystem,
                                 FastUserSwitchingCompatibility, helpsvc,
                                 Iprip, lanmanserver, lanmanworkstation,
                                 Messenger, Netman, Nla, RasMan, Schedule,
                                 seclogon, SENS, ShellHWDetection, srservice,
                                 TapiSrv, TermService, Themes, TrkWks,
                                 uploadmgr, W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe                  988 Dnscache
svchost.exe                 1052 LmHosts, RemoteRegistry, SSDPSRV, WebClient
explorer.exe                1280 N/A
spoolsv.exe                 1328 Spooler
Directcd.exe                1464 N/A
qttask.exe                  1528 N/A
mm_tray.exe                 1536 N/A
HotTray.exe                 1744 N/A
Dllcmd32.exe                1772 N/A
nvsvc32.exe                 1972 NVSvc
tcpsvcs.exe                  176 SimpTcp
Tmntsrv.exe                 3308 Tmntsrv
PCCPFW.exe                  3040 PCCPFW
PCCClient.exe               3264 N/A
pccguide.exe                3520 N/A
WebTrap.exe                 3540 N/A
Pop3trap.exe                3480 N/A
realsched.exe               1416 N/A
OUTLOOK.EXE                 2968 N/A
msmsgs.exe                  3388 N/A
WINWORD.EXE                 1788 N/A
iexplore.exe                1700 N/A
cmd.exe                     2796 N/A
UEDIT32.EXE                 1760 N/A
wmiprvse.exe                3840 N/A
tasklist.exe                3672 N/A

Windows XP also added commandline utility taskkill to kill processes by process id or image name. NT Resource Kit Server

Featured Links