Table of contents
TOC
Collapse the table of content
Expand the table of content

tasklist

Corey Plett|Last Updated: 11/16/2016

Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays a list of currently running processes on the local computer or on a remote computer. tasklist replaces the tlist tool. for examples of how to use this command, see Examples.

Syntax

tasklist [/s <computer> [/u [<Domain>\]<UserName> [/p <Password>]]] [{/m <Module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <Filter> [/fi <Filter> [ ... ]]]

Parameters

ParameterDescription
/s Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u [\]Runs the command with the account permissions of the user who is specified by UserName or Domain\UserName. /u can be specified only if /s is specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command.
/p Specifies the password of the user account that is specified in the /u parameter.
/m lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task.
/svclists all the service information for each process without truncation. Valid when the /fo parameter is set to table.
/vDisplays verbose task information in the output. For complete verbose output without truncation, use /v and /svc together.
/fo {table | list | csv}Specifies the format to use for the output. Valid values are table, list, and csv. The default format for output is table.
/nhSuppresses column headers in the output. Valid when the /fo parameter is set to table or csv.
/fi Specifies the types of processes to include in or exclude from the query. See the following table for valid filter names, operators, and values.
/?Displays help at the command prompt.

Filter names, operators, and values

Filter NameValid OperatorsValid Values
STatUSeq, neRUNNING | NOT RESPONDING | UNKNOWN
IMAGENAMEeq, neImage name
PIDeq, ne, gt, lt, ge, lePID value
SESSIONeq, ne, gt, lt, ge, leSession number
SESSIONNAMEeq, neSession name
CPUtimeeq, ne, gt, lt, ge, leCPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number
MEMUSAGEeq, ne, gt, lt, ge, leMemory usage in KB
USERNAMEeq, neAny valid user name
SERVICESeq, neService name
WINDOWTITLEeq, neWindow title
MODULESeq, neDLL name

remarks

  • The WINDOWTITLE and STatUS filters are not supported when a remote system is specified. ## Examples To list all tasks with a process ID greater than 1000, and display them in CSV format, type: tasklist /v /fi "PID gt 1000" /fo csv To list the system processes that are currently running, type: tasklist /fi "USERNAME ne NT AUTHORITY\SYSTEM" /fi "STatUS eq running" To list detailed information for all processes that are currently running, type: tasklist /v /fi "STatUS eq running" To list all the service information for processes on the remote computer "Srvmain" that have a DLL name beginning with "ntdll," type: tasklist /s srvmain /svc /fi "MODULES eq ntdll*" To list the processes on the remote computer "Srvmain," using the credentials of your currently logged-on user account, type: tasklist /s srvmain To list the processes on the remote computer "Srvmain," using the credentials of the user account Hiropln, type: tasklist /s srvmain /u maindom\hiropln /p p@ssW23 #### additional references Command-Line Syntax Key
© 2017 Microsoft