In multitasking operating systems you sometimes need to find out what processes are running, or you may even need to end one of the processes.
Until Windows XP there were no native commands to manage processes from the command line.
Windows XP has its TASKLIST and TASKKILL utilities.
There are some very good alternatives available for Windows NT 4 and 2000. Some of those will be discussed briefly on this page.
KILL.EXE
is part of the Windows NT 4 Resource Kit
Microsoft (R) Windows NT (TM) Version 3.5 KILL Copyright (C) 1994-1998 Microsoft Corp. All rights reserved usage: KILL [options] <<pid> | <pattern>>* [options]: -f Force process kill <pid> This is the process id for the task to be killed. Use TLIST to get a valid pid <pattern> The pattern can be a complete task name or a regular expression pattern to use as a match. Kill matches the supplied pattern against the task names and the window titles.
PSKILL.EXE
is part of
SysInternals's PSTools suite
PsKill v1.03 - local and remote process killer Copyright (C) 2000 Mark Russinovich http://www.sysinternals.com PsKill terminates processes on a local or remote NT system. Usage: pskill.exe [\\RemoteComputer [-u Username]] <process Id or name> -u Specifies optional user name for login to remote computer.
PSLIST.EXE
is part of SysInternals's PSTools suite
PsList v1.2 - Process Information Lister Copyright (C) 1999-2002 Mark Russinovich Sysinternals - www.sysinternals.com Usage: pslist.exe [-d][-m][-x][-t][-s [n] [-r n] [\\computer [-u username][-p password][name|pid] -d Show thread detail. -m Show memory detail. -x Show processes, memory information and threads. -t Show process tree. -s [n] Run in task-manager mode, for optional seconds specified. Press Escape to abort. -r n Task-manager mode refresh rate in seconds (default is 1). \\computer Specifies remote computer. -u Optional user name for remote login. -p Optional password for remote login. If you don't present on the command line pslist will prompt you for it if necessary. name Show information about specified process. pid Show information about specified process. All memory values are displayed in KB. Abbreviation key: Pri Priority Thd Number of Threads Hnd Number of Handles Mem Working Set VM Virtual Memory WS Working Set WS Pk Working Set Peak Priv Private Memory Faults Page Faults NonP Non-Paged Pool Page Paged Pool PageFile Pagefile usage Cswtch Context Switches
PULIST.EXE
is part of the Windows NT 4 Resource Kit
PULIST for Windows NT v1.00 Aug 30 1996 21:47:08 (c) Copyright 1996 Scott Field (sfield@microsoft.com) and Microsoft Corp. This utility displays all the processes running on a system. If no server name is specified, this utility will attempt to display the username associated with each process running on the local system. Usage: pulist.exe [\\Server] [\\Server...]
TASKKILL.EXE
is a native Windows XP command
TASKKILL [/S system [/U username [/P [password]]]] { [/FI filter] [/PID processid | /IM imagename] } [/F] [/T] Description: This command line tool can be used to end one or more processes. Processes can be killed by the process id or image name. Parameter List: /S system Specifies the remote system to connect to. /U [domain\]user Specifies the user context under which the command should execute. /P [password] Specifies the password for the given user context. Prompts for input if omitted. /F Specifies to forcefully terminate process(es). /FI filter Displays a set of tasks that match a given criteria specified by the filter. /PID process id Specifies the PID of the process that has to be terminated. /IM image name Specifies the image name of the process that has to be terminated. Wildcard '*' can be used to specify all image names. /T Tree kill: terminates the specified process and any child processes which were started by it. /? Displays this help/usage. Filters: Filter Name Valid Operators Valid Value(s) ----------- --------------- -------------- STATUS eq, ne RUNNING | NOT RESPONDING IMAGENAME eq, ne Image name PID eq, ne, gt, lt, ge, le PID value SESSION eq, ne, gt, lt, ge, le Session number. CPUTIME eq, ne, gt, lt, ge, le CPU time in the format of hh:mm:ss. hh - hours, mm - minutes, ss - seconds MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB USERNAME eq, ne User name in [domain\]user format MODULES eq, ne DLL name SERVICES eq, ne Service name WINDOWTITLE eq, ne Window title NOTE: Wildcard '*' for the /IM switch is accepted only with filters. NOTE: Termination of remote processes will always be done forcefully irrespective of whether /F option is specified or not. Examples: TASKKILL /S system /F /IM notepad.exe /T TASKKILL /PID 1230 /PID 1241 /PID 1253 /T TASKKILL /F /IM notepad.exe /IM mspaint.exe TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*" TASKKILL /F /FI "USERNAME eq NT AUTHORITY\SYSTEM" /IM notepad.exe TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM * TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"
TASKLIST.EXE
is a native Windows XP command
TASKLIST [/S system [/U username [/P [password]]]] [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH] Description: This command line tool displays a list of application(s) and associated task(s)/process(es) currently running on either a local or remote system. Parameter List: /S system Specifies the remote system to connect to. /U [domain\]user Specifies the user context under which the command should execute. /P [password] Specifies the password for the given user context. Prompts for input if omitted. /M [module] Lists all tasks that have DLL modules loaded in them that match the given pattern name. If the module name is not specified, displays all modules loaded by each task. /SVC Displays services in each process. /V Specifies that the verbose information is to be displayed. /FI filter Displays a set of tasks that match a given criteria specified by the filter. /FO format Specifies the output format. Valid values: "TABLE", "LIST", "CSV". /NH Specifies that the "Column Header" should not be displayed in the output. Valid only for "TABLE" and "CSV" formats. /? Displays this help/usage. Filters: Filter Name Valid Operators Valid Value(s) ----------- --------------- -------------- STATUS eq, ne RUNNING | NOT RESPONDING IMAGENAME eq, ne Image name PID eq, ne, gt, lt, ge, le PID value SESSION eq, ne, gt, lt, ge, le Session number SESSIONNAME eq, ne Session name CPUTIME eq, ne, gt, lt, ge, le CPU time in the format of hh:mm:ss. hh - hours, mm - minutes, ss - seconds MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB USERNAME eq, ne User name in [domain\]user format SERVICES eq, ne Service name WINDOWTITLE eq, ne Window title MODULES eq, ne DLL name Examples: TASKLIST TASKLIST /M TASKLIST /V TASKLIST /SVC TASKLIST /M wbem* TASKLIST /S system /FO LIST TASKLIST /S system /U domain\username /FO CSV /NH TASKLIST /S system /U username /P password /FO TABLE /NH TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"
TLIST.EXE
is part of the Windows NT 4 Resource Kit
Microsoft (R) Windows NT (TM) Version 3.51 TLIST Copyright (C) 1994 Microsoft Corp. All rights reserved usage: TLIST <<-t> | <pid> | <pattern>> [options]: -t Print Task Tree <pid> List module information for this task. <pattern> The pattern can be a complete task name or a regular expression pattern to use as a match. Tlist matches the supplied pattern against the task names and the window titles.
MYOWNPID.BAT uses TLIST from the NT 4 Resource Kit to display the batch file's own PID (Process ID).
This may prove useful to prevent "killing" itself when "killing" another batch file.
Do not call this batch file from within another batch file, but insert this code in the "killer" batch file itself instead.
Tested in Windows 2000.
@ECHO OFF :: Trick read on John Savill's Windows NT/2000 site :: http://www.ntfaq.com/Articles/Index.cfm?ArticleID=15339 FOR /F "tokens=1 delims= " %%A IN ('TLIST ^| FIND /I "%0"') DO SET PID=%%A ECHO My own Process ID (PID) is %PID%
This batch file handles multiple simultaneous CMD sessions by filtering its own batch file name from TLIST's output:
736 winmgmt.exe 748 mspmspsv.exe 192 explorer.exe Program Manager 1308 EM_EXEC.EXE 996 internat.exe 1213 cmd.exe C:\WINNT\system32\cmd.exe 1456 cmd.exe C:\WINNT\system32\cmd.exe - E:\Batch\MyOwnPID.bat 728 TLIST.EXE
By using FIND /I "%0"
(%0 happened to be E:\Batch\MyOwnPID.bat) the right process is found.
In order to make this filtering work, do not set the CMD session's title till after you determined the batch file's PID (TLIST actually displays the CMD session's title, which happens to be its command line unless a title is set).
This batch file will fail if it runs in multiple sessions simultaneously.
Use Daniel Scheibli's GetPIDs if that is to be expected.
Replacing TLIST by PSLIST makes it a little harder to determine the batch file's own PID, since PSLIST doesn't show the CMD sessions' command line.
However, the command:
PSLIST -d CMD
will display something similar to this:
PsList v1.2 - Process Information Lister Copyright (C) 1999-2002 Mark Russinovich Sysinternals - www.sysinternals.com Thread detail for MYCOMPUTER: cmd 1528: Tid Pri Cswtch State User Time Kernel Time Elapsed Time 1132 8 503 Wait:LpcReply 0:00:00.010 0:00:00.010 0:01:22.448 cmd 728: Tid Pri Cswtch State User Time Kernel Time Elapsed Time 908 8 520 Wait:LpcReply 0:00:00.010 0:00:00.010 0:01:19.083 cmd 1268: Tid Pri Cswtch State User Time Kernel Time Elapsed Time 988 9 579 Wait:UserReq 0:00:00.010 0:00:00.040 0:01:16.009
In this example the CMD session with process ID 1268 is the CMD session
running the batch file.
The column named "State" will either display "Wait:LpcReply", "Wait:UserReq",
"Wait:Executive" or "Ready".
After many tests it seems that only one CMD session will not be in
the "Wait:LcpReply" state, the one running the batch file.
The following code will determine which CMD session has the highest priority
and display that session's PID:
@ECHO OFF SETLOCAL SET PID= FOR /F "skip=1 tokens=1,2,4 delims= " %%A IN ('PSLIST -d CMD ^| FIND ":"') DO CALL :HiPrio %%A %%B %%C SET PID ENDLOCAL GOTO:EOF :HiPrio IF DEFINED PID GOTO:EOF IF /I "%1"=="CMD" SET TmpPID=%2 IF /I "%1"=="CMD" SET TmpPID=%TmpPID::=% IF /I "%3"=="Ready" SET PID=%TmpPID% IF DEFINED PID GOTO:EOF IF /I "%3"=="Wait:Executive" SET PID=%TmpPID% IF DEFINED PID GOTO:EOF IF /I "%3"=="Wait:UserReq" SET PID=%TmpPID% GOTO:EOF
This code should be inserted in the batch file that needs to determine its own process ID.
Warning: | This code has been tested on one computer only! It is to be considered "experimental". Use it entirely at your own risk. |
Windows XP's TASKLIST /V
command will result in a list like this:
Image Name PID Session Name Session# Mem Usage Status User Name CPU Time Window Title ========================= ====== ================ ======== ============ =============== ================================================== ============ ======================================================================== System Idle Process 0 Console 0 20 K Running NT AUTHORITY\SYSTEM 0:13:02 N/A System 4 Console 0 216 K Running NT AUTHORITY\SYSTEM 0:00:07 N/A smss.exe 432 Console 0 348 K Running NT AUTHORITY\SYSTEM 0:00:00 N/A csrss.exe 488 Console 0 3.928 K Running NT AUTHORITY\SYSTEM 0:00:07 N/A winlogon.exe 512 Console 0 3.212 K Running NT AUTHORITY\SYSTEM 0:00:01 NetDDE Agent services.exe 556 Console 0 2.740 K Running NT AUTHORITY\SYSTEM 0:00:02 N/A lsass.exe 568 Console 0 1.524 K Running NT AUTHORITY\SYSTEM 0:00:00 N/A svchost.exe 732 Console 0 3.440 K Running NT AUTHORITY\SYSTEM 0:00:00 N/A svchost.exe 804 Console 0 12.728 K Running NT AUTHORITY\SYSTEM 0:00:03 N/A svchost.exe 888 Console 0 2.740 K Running NT AUTHORITY\NETWORK SERVICE 0:00:00 N/A svchost.exe 936 Console 0 3.660 K Running NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A spoolsv.exe 1124 Console 0 4.000 K Running NT AUTHORITY\SYSTEM 0:00:00 N/A explorer.exe 1348 Console 0 21.648 K Running MYCOMPUTER\MyID 0:00:17 N/A point32.exe 1604 Console 0 2.604 K Running MYCOMPUTER\MyID 0:00:00 N/A qttask.exe 1676 Console 0 896 K Running MYCOMPUTER\MyID 0:00:00 N/A ctfmon.exe 1780 Console 0 2.016 K Running MYCOMPUTER\MyID 0:00:00 N/A cmd.exe 1354 Console 0 1.296 K Running MYCOMPUTER\MyID 0:00:00 C:\WINDOWS\System32\cmd.exe - dir i:\ /s/b/on msmsgs.exe 1788 Console 0 3.232 K Running MYCOMPUTER\MyID 0:00:00 N/A nvsvc32.exe 1952 Console 0 1.824 K Running NT AUTHORITY\SYSTEM 0:00:00 NVSVCPMMWindowClass svchost.exe 204 Console 0 2.472 K Running NT AUTHORITY\SYSTEM 0:00:00 N/A devldr32.exe 344 Console 0 2.544 K Running MYCOMPUTER\MyID 0:00:00 DEVLDR cmd.exe 1252 Console 0 1.296 K Running MYCOMPUTER\MyID 0:00:00 C:\WINDOWS\System32\cmd.exe - tasklist /v wmiprvse.exe 1928 Console 0 3.956 K Running NT AUTHORITY\NETWORK SERVICE 0:00:00 N/A tasklist.exe 332 Console 0 2.740 K Running MYCOMPUTER\MyID 0:00:00 OleMainThreadWndName
Each line starting with cmd.exe displays — amongst others — the console's command line.
This can be used to determine the batch file's own PID in a simple one liner:
@ECHO OFF :: Determine the PID in Windows XP FOR /F "tokens=2 delims= " %%A IN ('TASKLIST /V ^| FIND /I "%~0"') DO SET MyPID=%%A
The same limitations mentioned for TLIST are valid for this batch file as well:
Have you ever wondered why there are multiple instances of SvcHost running on your computer, and what services each of these SvcHost processes "hosts"?
Well, probably not, but I'll continue anyway.
The following command (for Windows XP and later) will show you more details for each SvcHost process:
TASKLIST /FI "imagename eq svchost.exe" /SVC
The result will most likely look like this:
Image Name PID Services ========================= ====== ============================================= svchost.exe 1500 DcomLaunch, TermService svchost.exe 1604 RpcSs svchost.exe 1720 AudioSrv, BITS, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, helpsvc, HidServ, lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, SharedAccess, srservice, TapiSrv, Themes, TrkWks, W32Time, winmgmt, wscsvc, wuauserv, WZCSVC svchost.exe 1816 Dnscache svchost.exe 1964 LmHosts, RemoteRegistry, WebClient svchost.exe 2248 stisvc
Credits: mygreenpaste.blogspot.com
page last modified: 2018-12-24; loaded in 0.0015 seconds