Tasklist - DOS/Command Prompt Reference

[Windows XP Professional / Vista or later] Displays a list of processes running on the computer.

Syntax
Details
Samples
See also

Syntax

tasklist[.exe] [/S <remote-system> [/U <user-name> [/P [<password>]]]]
  [/M [<module-name>] | /SVC | /V] [/APPS] [/FI <filter>]
  [/FO <output-format>] [/NH]

Options

/S <remote-system>

Specifies the name of the computer (local/remote) from which to retrieve a list of processes. <remote-system> will be an IP address or hostname. If omitted, the local computer is the target.

/U <user-name> [/P [<password>]]

Specifies the login name and password when providing a computer name. You can specify a domain name in <user-name> (in the form of ‘domain\username’). If omitted, the user who executed this command will be used.

On ‘/P [<password>]’, if the entire ‘/P [<password>]’ is omitted, no password is set. If only ‘/P’ is specified (and ‘<password>’ is omitted), prompting the user to enter the password will occur (the entered password will be displayed as ‘*’ in the prompt).

/M [<module-name>]

If <module-name> is specified, displays only the processes that have loaded the module (DLL, etc.) specified in <module-name>. <module-name> can have the wildcard ‘*’ specified only at the end.

If <module-name> is not specified, and only ‘/M’ is specified, displays all the module names that the process has loaded when showing the list of processes. Note that this operation may take some time.

If ‘/M’ is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will not be displayed.

You can obtain the same list using ‘/FI "MODULES eq <module-name>"’, but when specified with a filter, the module name will not be displayed.

/M cannot be specified with /SVC and /V.

/SVC

When displaying the list of processes, shows the names of the ‘services’ associated with each process. If /SVC is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will not be displayed.

Displays the ‘Status’, ‘User Name’, ‘CPU Time’, and ‘Window Title’ items in the list of processes. Depending on the situation, obtaining this information may take some time.

If /V is specified, the items ‘Session Name’, ‘Session#’, and ‘Mem Usage’ will also be displayed.

/APPS

[Windows 10? or later] Displays only processes based on Microsoft Store applications.

/APPS cannot be specified with /M and /SVC , but can be specified with /V.

/FI <filter>

Narrows down (filters) the processes to be displayed in the list of processes. Please refer to Details for the available formats that can be specified.

/FI can be specified multiple times. In such cases, it becomes an AND search (display only those that match all filters).

/FO <output-format>

Specifies the format for outputting to the screen. The three available values are as follows. If /FO is omitted, it defaults to ‘TABLE’.

Value for format	Meaning
TABLE	Outputs in a pseudo-table format. You can see multiple processes lined up, but if ‘/V’ is specified, it may use a wider width, causing display issues in the default command prompt width.
LIST	Displays information for each process in a bullet-point-like format. It improves readability, but if no filter is specified or multiple processes match, the output volume may increase. Note that when specifying LIST, you cannot use the ‘/NH’ option.
CSV	Outputs in CSV format. This is useful if you want to parse the output, such as passing it to a For command.

/NH

Does not output headers when displaying in TABLE or CSV format.

Details

The Tasklist command outputs processes that match the specified filters among the running processes. If you want to terminate a process, use Taskkill.

Filters specified with the /FI option are in the form of ‘<name> <op> <value>’ (enclose the entire expression in " "). The available filters are as follows (same as those that can be used with Tasklist, excluding ‘SESSIONNAME’).

Filter name <name>	Available comparison op. <op>(*)	Target
CPUTIME	eq, ne, gt, lt, ge, le	CPU time. <value> must be the format ‘hh:mm:ss’ (hours:minutes:seconds; minutes and seconds are one or two digits).
IMAGENAME	eq, ne	Process name (Image name). <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. (It is not a partial match.)
MEMUSAGE	eq, ne, gt, lt, ge, le	Memory usage. <value> must be a numeric value (in KiB).
MODULES	eq, ne	Modules loaded by the process. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. A single process typically loads multiple modules, but with this filter, the process is included in the results if any of the modules meet the specified conditions.
PID	eq, ne, gt, lt, ge, le	Process ID. <value> must be a numeric value.
SERVICES	eq, ne	Service name that the process belongs to. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. A single process may belong to multiple services, but with this filter, the process is included in the results if any of the services meet the specified conditions.
SESSION	eq, ne, gt, lt, ge, le	Session number. <value> must be a numeric value.
SESSIONNAME	eq, ne	Session name. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end.
STATUS(*)	eq, ne	Process status. <value> must be either of ‘RUNNING’, ‘NOT RESPONDING’, or ‘UNKNOWN’.
USERNAME	eq, ne	User name. <value> must be the format ‘[Domain-name\]User-name’. You can use the wildcard ‘*’ at the end of ‘User-name’.
WINDOWTITLE(*)	eq, ne	Title name of the main window that the process possesses. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end.

* Comparison ops. are: eq: equal, ne: not equal, gt: greater than, lt: less than, ge: greater than or equal to, le: less than or equal to
* When targeting processes on a remote computer, ‘STATUS’ and ‘WINDOWTITLE’ cannot be used.

The order of items output in TABLE or CSV is as follows. Numbers indicate the position in CSV, and ‘×’ indicates that the item is not output.

Name	Default	/M	/SVC	/V	/APPS	/APPS /V
Image	1	1	1	1	1	1
PID	2	2	2	2	2	2
Session Name	3	×	×	3	×	3
Session#	4	×	×	4	×	4
Mem Usage	5	×	×	5	3	5
Modules	×	3	×	×	×	×
Services	×	×	3	×	×	×
Status	×	×	×	6	×	6
User Name	×	×	×	7	×	7
CPU Time	×	×	×	8	×	8
Window Title	×	×	×	9	×	9
Package Name	×	×	×	×	4	10

Samples

Sample 1

tasklist /FI "imagename eq excel*"

Displays a table of processes whose image name (process name) starts with ‘excel’.

Sample 2

tasklist /FI "pid lt 1000" /FO CSV

Displays processes with a Process ID less than 1000 in CSV format.

Sample 3 (Batch file)

type NUL > nplist.txt
for /f "usebackq tokens=1,2 delims=," %%a in (`tasklist /FI "imagename eq notepad*" /FO CSV /NH`) do (
    echo %%~a: %%~b>> nplist.txt
)

[Extensions] Retrieves processes with an image name (process name) starting with ‘notepad’ and outputs their image name and PID to the file ‘nplist.txt’. Using For, the script parses the output of Tasklist, and assigns the first (image name) and second (PID) elements of CSV to variables %%a and %%b. Note that since the values are enclosed in " ", the ‘~’ modifier is used to remove them (see ‘%’).

* If no matching processes are found, an error message will be displayed on the screen.