TASKLIST Command – Display Running Processes in Windows

The TASKLIST command is a Windows Command Prompt utility that displays a list of all currently running processes on the local or remote computer, including process ID (PID), memory usage, and session information. Use TASKLIST to monitor system performance, identify resource-hogging applications, filter processes by criteria with /FI, display associated services with /SVC, or format output for scripting and automation—essential for system diagnostics, process management, and troubleshooting.

Whether you're a system administrator diagnosing performance issues and identifying rogue processes, a developer monitoring application memory consumption during testing, or a power user investigating high CPU usage and system slowdowns, TASKLIST provides comprehensive visibility into running processes without requiring Task Manager. IT professionals rely on TASKLIST for automated monitoring scripts, resource auditing, and process inventory across enterprise environments.

This comprehensive guide covers TASKLIST syntax, all parameters and filter options, practical examples for process listing and monitoring, troubleshooting tips for common issues, related process management commands, and frequently asked questions. By the end, you'll confidently use TASKLIST for process monitoring, performance diagnostics, and automated system administration in Windows environments.

What Is the TASKLIST Command?

The TASKLIST command is a powerful system diagnostic tool in Windows Command Prompt that displays detailed information about running processes, including executable name, process ID (PID), session name, session number, memory usage, status, username, CPU time, and window title.

TASKLIST works in Command Prompt (CMD), Windows PowerShell (with CMD compatibility), Windows Terminal, and is available in Windows XP through Windows 11, Windows Server 2003 through Windows Server 2022, and all enterprise editions. Its filtering and formatting capabilities make it superior to basic process listing tools for scripting and automation.

The command's extensive filter options (/FI) enable precise process identification by name, PID, memory usage, status, session, username, services, and more. System administrators use TASKLIST in monitoring scripts to detect unauthorized processes, track resource consumption, verify service status, and generate process inventory reports for security audits and compliance documentation.

TASKLIST vs Task Manager

While Task Manager provides a graphical interface for process viewing, TASKLIST offers:

Command-line automation – Scriptable process monitoring and reporting
Precise filtering – Filter by multiple criteria with /FI operator
Remote computer access – Query processes on network computers
Parseable output – CSV, TABLE, and LIST formats for automated processing

Most system administration and monitoring scripts use TASKLIST for its scriptability and remote access capabilities.

Syntax

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Parameters

Parameter	Description
`/S system`	Specifies the remote system to connect to
`/U [domain\]user`	Specifies the user context under which to execute
`/P [password]`	Specifies the password for the given user context
`/M [module]`	Lists tasks that have DLL modules loaded matching the given pattern
`/SVC`	Displays services hosted in each process
`/V`	Displays verbose task information
`/FI filter`	Displays a set of tasks that match given criteria specified by the filter
`/FO format`	Specifies output format: TABLE, LIST, or CSV
`/NH`	Specifies that column headers should not be displayed in the output

No parameters: Running TASKLIST without arguments displays all running processes in default TABLE format with basic information.

Filter operators: eq (equals), ne (not equal), gt (greater than), lt (less than), ge (greater than or equal), le (less than or equal).

How to Use TASKLIST Command

Display All Running Processes

List all processes on the local computer:

TASKLIST

Output shows image name, PID, session name, session number, and memory usage in default TABLE format.

Display Processes with Services

Show which services are running in each process:

TASKLIST /SVC

Useful for identifying which svchost.exe instances host specific services. System administrators use this to diagnose service-related issues and understand service dependencies.

Display Verbose Process Information

Show detailed information including status, username, CPU time, and window title:

TASKLIST /V

Provides comprehensive process details including user context, session type, and window titles for GUI applications.

Filter Processes by Name

Display only processes matching a specific image name:

TASKLIST /FI "IMAGENAME eq chrome.exe"
TASKLIST /FI "IMAGENAME eq svchost.exe"
TASKLIST /FI "IMAGENAME eq explorer.exe"

Use exact executable name (case-insensitive) to find specific processes.

Filter Processes by Status

Show only running or not responding processes:

TASKLIST /FI "STATUS eq RUNNING"
TASKLIST /FI "STATUS eq NOT RESPONDING"

Quickly identify hung or unresponsive applications without opening Task Manager.

Filter Processes by Memory Usage

Find processes using more than a specific amount of memory:

TASKLIST /FI "MEMUSAGE gt 100000"
TASKLIST /FI "MEMUSAGE gt 500000"

Memory is specified in kilobytes (KB). Use to identify memory-intensive processes consuming system resources.

Filter Processes by PID

Display information about a specific process ID:

TASKLIST /FI "PID eq 1234"
TASKLIST /FI "PID ne 0"

Useful for verifying whether a specific PID is still running or gathering details about a known process.

Filter Processes by Username

Show processes running under a specific user account:

TASKLIST /FI "USERNAME eq DOMAIN\user"
TASKLIST /FI "USERNAME eq NT AUTHORITY\SYSTEM"
TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM"

System administrators use this to audit user processes, identify unauthorized sessions, or troubleshoot user-specific issues.

Combine Multiple Filters

Use multiple /FI parameters to narrow results:

TASKLIST /FI "IMAGENAME eq chrome.exe" /FI "MEMUSAGE gt 100000"
TASKLIST /FI "STATUS eq NOT RESPONDING" /FI "USERNAME eq %USERNAME%"

Each filter is applied with AND logic, progressively narrowing the process list.

Format Output as CSV

Export process list to CSV format for spreadsheet analysis:

TASKLIST /FO CSV
TASKLIST /FO CSV /NH > processes.csv

Use /NH to omit column headers when appending to existing CSV files. Excellent for automated reporting and data analysis.

Format Output as List

Display processes in LIST format with one property per line:

TASKLIST /FO LIST
TASKLIST /FO LIST /FI "IMAGENAME eq explorer.exe"

LIST format is more readable for detailed single-process examination but less suitable for scripting.

Query Remote Computer

Display processes on a remote system:

TASKLIST /S remotecomputer /U domain\admin /P password
TASKLIST /S 192.168.1.100 /U admin /P

Requires administrative credentials on the remote system. Omit /P to be prompted for password (more secure than command-line password).

Display DLL Modules Loaded by Processes

Show processes that have loaded specific DLL modules:

TASKLIST /M
TASKLIST /M ntdll.dll
TASKLIST /M kernel32.dll

Without a module name, shows all modules for all processes. With a module name, shows only processes using that DLL—useful for troubleshooting DLL conflicts or malware analysis.

Save Process List to File

Redirect output to a text file for documentation or analysis:

TASKLIST > processes.txt
TASKLIST /V > detailed_processes.txt
TASKLIST /SVC > services_processes.txt

Capture snapshots of running processes for comparison, troubleshooting, or security audits.

Common Use Cases

Monitor system performance – Use TASKLIST to identify processes consuming excessive CPU or memory during performance troubleshooting.
Identify not responding applications – Use TASKLIST /FI "STATUS eq NOT RESPONDING" to quickly find hung processes without opening Task Manager.
Verify service status – Use TASKLIST /SVC to confirm which services are running and which svchost.exe process hosts specific services.
Track process resource usage – Use TASKLIST /FI "MEMUSAGE gt 100000" to find memory-intensive processes during memory leak investigations.
Security auditing – Use TASKLIST /V to capture complete process inventory with usernames for security compliance and unauthorized process detection.
Remote system monitoring – Use TASKLIST /S remotecomputer to monitor processes on servers and workstations across the network without RDP.
Process existence verification – Use TASKLIST /FI "IMAGENAME eq app.exe" in scripts to verify whether a process is running before taking action.
Generate process reports – Use TASKLIST /FO CSV > report.csv to create timestamped process snapshots for trend analysis and capacity planning.
Troubleshoot high CPU usage – Use TASKLIST with /V to identify which user or application is responsible for CPU spikes during performance issues.
Malware detection – Use TASKLIST to identify suspicious processes, unknown executables, or processes running from unusual locations during security investigations.
Application debugging – Use TASKLIST /FI "IMAGENAME eq myapp.exe" to verify whether your application is running and check its PID and memory usage.
Service host analysis – Use TASKLIST /SVC /FI "IMAGENAME eq svchost.exe" to understand which services are grouped in each svchost.exe instance.

Tips and Best Practices

Combine with FINDSTR for powerful filtering – Use TASKLIST | FINDSTR /I "chrome" to search process list for patterns not supported by /FI.
Use /V for complete information – Include /V parameter to get username, status, and window titles—essential for comprehensive process analysis.
Filter by memory to find resource hogs – Use TASKLIST /FI "MEMUSAGE gt 500000" to quickly identify processes using more than 500 MB of RAM.
Redirect to CSV for analysis – Use TASKLIST /FO CSV /NH > processes.csv to export data for Excel analysis, trending, and reporting.
Check for hung processes – Use TASKLIST /FI "STATUS eq NOT RESPONDING" to find frozen applications that need termination.
Run as Administrator for complete access – Elevate Command Prompt to see all processes, including system processes and services running under SYSTEM account.
Use /SVC to troubleshoot services – Combine /SVC with filtering to understand service-to-process relationships and diagnose service failures.
Omit passwords from scripts – Use TASKLIST /S computer /U user /P * to prompt for password instead of storing passwords in batch files.
Monitor specific applications – Use TASKLIST /FI "IMAGENAME eq app.exe" /FI "MEMUSAGE gt 100000" to track specific application resource usage over time.
Export without headers for appending – Use /NH parameter when appending to existing log files to avoid duplicate column headers.
Use on remote systems for centralized monitoring – Deploy TASKLIST in monitoring scripts to collect process data from multiple servers without agent installation.
Verify process before TASKKILL – Always use TASKLIST to confirm target process PID and image name before using TASKKILL to avoid terminating wrong processes.

Troubleshooting Common Issues

Access Denied Error on Remote Computer

Problem: TASKLIST /S remotecomputer returns "ERROR: Access is denied."

Cause: Insufficient permissions on the remote system or Remote Registry service not running.

Solution:

Verify administrative credentials: TASKLIST /S remotecomputer /U domain\admin /P password
Ensure Remote Registry service is running on the remote computer
Check firewall rules allow WMI and RPC traffic
Verify the account has "Access this computer from the network" right

Prevention: Use domain administrator account or local administrator account on the remote system; enable Remote Registry service.

No Processes Returned with Filter

Problem: TASKLIST /FI "IMAGENAME eq app.exe" returns "INFO: No tasks are running which match the specified criteria."

Cause: Process doesn't exist, incorrect image name, or case sensitivity issue.

Solution: Run TASKLIST without filters to see exact process names:

TASKLIST | FINDSTR /I "app"

Then use exact name: TASKLIST /FI "IMAGENAME eq AppName.exe"

Prevention: Always verify exact process name (including .exe extension) before filtering; TASKLIST is case-insensitive but spelling must be exact.

Cannot Query Processes on Windows 10/11

Problem: TASKLIST returns incomplete information or fails to display all processes.

Cause: Running in non-elevated Command Prompt; protected processes require Administrator rights.

Solution: Run Command Prompt as Administrator:

Right-click Command Prompt
Select "Run as administrator"
Run TASKLIST /V to see all processes

Prevention: Always use elevated Command Prompt for complete process visibility, especially when monitoring system services.

Memory Usage Values Seem Incorrect

Problem: Memory usage displayed by TASKLIST doesn't match Task Manager.

Cause: TASKLIST shows working set (physical RAM), while Task Manager can show different memory metrics (private working set, commit size).

Solution: TASKLIST displays "Mem Usage" as working set in KB. For detailed memory analysis:

WMIC PROCESS WHERE "name='chrome.exe'" GET ProcessId,WorkingSetSize,PrivatePageCount

Prevention: Understand that TASKLIST shows working set memory; use Task Manager or WMIC for more detailed memory breakdowns.

Remote Computer Not Found

Problem: TASKLIST /S remotecomputer returns "ERROR: The RPC server is unavailable."

Cause: Remote computer is offline, hostname is incorrect, or firewall blocks RPC traffic.

Solution:

Verify connectivity: PING remotecomputer
Try IP address: TASKLIST /S 192.168.1.100 /U admin /P
Check firewall allows RPC (TCP 135) and dynamic RPC ports
Verify Remote Registry service is running

Prevention: Use IP addresses for reliability; configure Windows Firewall to allow RPC for remote management.

CSV Output Has Missing Fields

Problem: TASKLIST /FO CSV output is missing expected columns.

Cause: Using basic TASKLIST without /V parameter limits available fields.

Solution: Use /V for all fields:

TASKLIST /FO CSV /V > complete_processes.csv

Without /V, only basic fields (Image Name, PID, Session Name, Session#, Mem Usage) are available.

Prevention: Always use /V parameter when exporting to CSV for comprehensive data capture.

Related Commands

TASKKILL – Terminate Processes

TASKKILL terminates processes by PID or image name. Use after TASKLIST to identify and terminate processes.

Example:

TASKLIST /FI "IMAGENAME eq notepad.exe"
TASKKILL /IM notepad.exe /F

Integration: TASKLIST identifies processes, TASKKILL terminates them—always verify with TASKLIST before killing.

WMIC PROCESS – Advanced Process Management

WMIC PROCESS provides more detailed process information and management capabilities using Windows Management Instrumentation.

Example:

WMIC PROCESS WHERE "name='chrome.exe'" GET ProcessId,CommandLine,ExecutablePath

When to use: Use WMIC for advanced queries, command-line parameters, or when TASKLIST doesn't provide enough detail.

SC – Service Control Manager

SC manages Windows services. Use with TASKLIST /SVC to understand service-to-process relationships.

Example:

TASKLIST /SVC /FI "IMAGENAME eq svchost.exe"
SC query wuauserv

Integration: TASKLIST shows which process hosts a service, SC manages the service itself.

SYSTEMINFO – System Information

SYSTEMINFO displays comprehensive system configuration. Use with TASKLIST for complete system inventory.

Example:

SYSTEMINFO > system.txt
TASKLIST /V > processes.txt

When to use: Combine SYSTEMINFO and TASKLIST in documentation scripts for complete system snapshots.

NETSTAT – Network Connections

NETSTAT displays network connections and listening ports. Use with TASKLIST to identify which processes own network connections.

Example:

NETSTAT -ano
TASKLIST /FI "PID eq 1234"

Integration: NETSTAT shows network activity with PIDs, TASKLIST identifies the processes behind those PIDs.

QUERY – Terminal Services Sessions

QUERY SESSION displays terminal services sessions. Use with TASKLIST to understand session-to-process relationships.

Example:

QUERY SESSION
TASKLIST /V

When to use: On Terminal Servers or Remote Desktop hosts, combine QUERY SESSION with TASKLIST to track user sessions and processes.

Frequently Asked Questions

What does TASKLIST command do?

TASKLIST displays all currently running processes on the local or remote computer, showing image name, process ID (PID), session information, and memory usage. Use TASKLIST to monitor system performance, identify resource-hogging applications, verify process existence, or filter processes by criteria like name, status, memory usage, or username.

How do I list all running processes in CMD?

Run TASKLIST without parameters to display all running processes in table format. For detailed information including username and status, use TASKLIST /V. For services information, use TASKLIST /SVC. Example: TASKLIST /V shows comprehensive details for all processes.

How do I filter TASKLIST output?

Use the /FI parameter with filter criteria. Examples: TASKLIST /FI "IMAGENAME eq chrome.exe" shows only Chrome processes, TASKLIST /FI "MEMUSAGE gt 100000" shows processes using more than 100 MB RAM, TASKLIST /FI "STATUS eq NOT RESPONDING" shows hung processes. Combine multiple /FI parameters for complex filtering.

What is the difference between TASKLIST and Task Manager?

TASKLIST is a command-line tool for scriptable process monitoring and automation, while Task Manager is a GUI application. TASKLIST supports remote computer queries, precise filtering with /FI, CSV output for data processing, and integration with batch scripts. Task Manager provides interactive process management, performance graphs, and easier sorting. Use TASKLIST for automation, Task Manager for manual intervention.

How do I save TASKLIST output to a file?

Redirect output using > or >>: TASKLIST > processes.txt saves to a file, TASKLIST >> log.txt appends to existing file. For CSV format: TASKLIST /FO CSV > processes.csv. For reports without headers: TASKLIST /FO CSV /NH >> report.csv. Example: TASKLIST /V > "C:\Logs\processes_%DATE%.txt" creates timestamped logs.

How do I view processes on a remote computer?

Use /S for remote system, /U for username, /P for password: TASKLIST /S remotecomputer /U domain\admin /P password. For prompted password (more secure): TASKLIST /S remotecomputer /U admin /P *. Requires administrative privileges on remote system and Remote Registry service running. Example: TASKLIST /S 192.168.1.100 /U administrator /V.

What does TASKLIST /SVC show?

TASKLIST /SVC displays services hosted in each process, particularly useful for identifying which Windows services run in each svchost.exe instance. Example output shows process name, PID, and list of service short names. Use to troubleshoot service issues, understand service-to-process relationships, or identify which svchost.exe to investigate during performance problems.

Why does TASKLIST show "Access Denied"?

"Access Denied" occurs when querying system processes without Administrator rights or accessing remote computers without proper permissions. Run Command Prompt as Administrator for complete local access. For remote computers, use domain or local administrator credentials: TASKLIST /S computer /U domain\admin /P password. Ensure Remote Registry service is running on the target system.

How do I find processes using high memory with TASKLIST?

Use memory filter: TASKLIST /FI "MEMUSAGE gt 100000" shows processes using more than 100 MB (values are in KB). For processes over 500 MB: TASKLIST /FI "MEMUSAGE gt 500000". Combine with /V for detailed information: TASKLIST /V /FI "MEMUSAGE gt 200000". Sort or analyze results by redirecting to CSV: TASKLIST /FO CSV /FI "MEMUSAGE gt 100000" > high_memory.csv.

Can TASKLIST show process command line arguments?

No, TASKLIST doesn't display command-line arguments. Use WMIC PROCESS GET ProcessId,CommandLine to see full command lines. Example: WMIC PROCESS WHERE "name='java.exe'" GET ProcessId,CommandLine. Or in PowerShell: Get-Process | Select-Object Name,Id,CommandLine. TASKLIST is limited to basic process information; use WMIC or PowerShell for advanced details.

How do I find a process ID (PID) with TASKLIST?

Use image name filter: TASKLIST /FI "IMAGENAME eq notepad.exe" shows PID in the second column. For specific window: TASKLIST /V /FI "WINDOWTITLE eq Document - Notepad". To find by username: TASKLIST /V /FI "USERNAME eq DOMAIN\user". Extract PID in scripts with: FOR /F "tokens=2" %%i IN ('TASKLIST /FI "IMAGENAME eq app.exe" /NH') DO SET PID=%%i.

What output formats does TASKLIST support?

TASKLIST supports three formats via /FO parameter: TABLE (default, column-aligned for console viewing), LIST (one property per line for readability), and CSV (comma-separated for spreadsheets). Examples: TASKLIST /FO TABLE, TASKLIST /FO LIST, TASKLIST /FO CSV > processes.csv. Use /NH to omit column headers in TABLE or CSV format for appending or parsing.

Quick Reference Card

Command	Purpose	Example Use Case
`TASKLIST`	Show all processes	Quick process overview
`TASKLIST /V`	Show detailed info	Get usernames and status
`TASKLIST /SVC`	Show services	Identify svchost.exe services
`TASKLIST /FI "IMAGENAME eq app.exe"`	Filter by name	Find specific process
`TASKLIST /FI "STATUS eq NOT RESPONDING"`	Find hung processes	Identify frozen apps
`TASKLIST /FI "MEMUSAGE gt 100000"`	High memory processes	Find memory leaks
`TASKLIST /FO CSV > file.csv`	Export to CSV	Generate reports
`TASKLIST /S computer /U user`	Remote processes	Monitor network computers
`TASKLIST /M ntdll.dll`	Show DLL usage	Troubleshoot DLL issues

Try TASKLIST Command Now

Ready to practice process monitoring and system diagnostics? Use our Windows Command Simulator to run TASKLIST commands safely in your browser. No installation required—practice TASKLIST, process filtering, output formatting, and resource monitoring in a risk-free environment. Perfect for learning, training, or testing command sequences before running them on production systems.

Explore the full Commands Reference for more Windows CMD utilities, including process management (TASKKILL, WMIC, SC), system information (SYSTEMINFO, VER), and network diagnostics (NETSTAT, PING).

Summary

The TASKLIST command is the essential Windows tool for displaying and monitoring running processes from the command line. Use TASKLIST to view all processes, filter by name or criteria with /FI, display services with /SVC, show detailed information with /V, format output as CSV or LIST, and query processes on remote computers.

Start with basic TASKLIST for process overviews, add /V for comprehensive details, use /FI filters to narrow results by image name, memory usage, status, or username, and combine with TASKKILL to identify and terminate problematic processes. Master TASKLIST for performance diagnostics, security auditing, automated monitoring, and troubleshooting in Windows environments.

Understanding TASKLIST is fundamental to Windows system administration and process management. The command's filtering capabilities, remote access support, and scriptable output formats make it indispensable for IT professionals managing servers, troubleshooting performance issues, auditing running processes, and building automated monitoring solutions across enterprise Windows infrastructure.