What command can be used to determine who is logged in and what their current running tasks are?

Skip to main content

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Finding the process ID

• Article
• 03/18/2022
• 2 minutes to read

In this article

Each process running in Windows is assigned a unique decimal number called the process ID (PID). This number is used in a number of ways, for example to specify the process when attaching a debugger to it.

This topic describes how you can determine the PID for a given app using Task Manager, the tasklist Windows command, the TList utility, the PowerShell Get-Process command, or the debugger.

Task Manager

Task Manager can be opened in a number of ways, but the simplest is to select Ctrl+Alt+Delete, and then select Task Manager.

In Windows, first click More details to expand the information displayed. From the Processes tab, select Details to see the process ID listed in the PID column.

Click on any column name to sort. You can right click a process name to see more options for a process.

Some kernel errors may cause delays in Task Manager's graphical interface.

The tasklist command

Use the built in Windows tasklist command from a command prompt to display all processes, their PIDs, and a variety of other details.

C:\>tasklist Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ System Idle Process 0 Services 0 8 K System 4 Services 0 7,428 K Secure System 104 Services 0 40,344 K Registry 164 Services 0 146,596 K smss.exe 592 Services 0 1,176 K csrss.exe 896 Services 0 6,224 K wininit.exe 980 Services 0 6,572 K ...

Use tasklist /? to display command line help.

TList utility

Task List Viewer (TList), or tlist.exe, is a command-line utility that displays the list of tasks, or user-mode processes, currently running on the local computer. TList is included in the Debugging Tools for Windows. For information on how to download and install the debugging tools, see Download Debugging Tools for Windows.

If you installed the Windows Driver Kit in the default directory on a 64 bit PC, the debugging tools are located here:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\

When you run TList from the command prompt, it will display a list of all the user-mode processes in memory with a unique PID number. For each process, it shows the PID, process name, and, if the process has a window, the title of that window.

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64>tlist -t System Process (0) System (4) smss.exe (592) Memory Compression (3376) Secure System (104) Registry (164) csrss.exe (896) wininit.exe (980) services.exe (660) svchost.exe (1232) WmiPrvSE.exe (6008) dllhost.exe (1748) WmiPrvSE.exe (1860) ...

For more information, see TList.

The .tlist debugger command

If there's already a user-mode debugger running on the system in question, the .tlist (List Process IDs) command will display a list of all PIDs on that system.

PowerShell Get-Process command

To work with automation scripts, use the Get-Process PowerShell command. Specify a specific process name, to see the process ID for that process.

C:\> Get-Process explorer Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 2520 404 108948 179284 1,702.95 7656 1 explorer

For more information, see Get-Process.

Additional resources

To learn more about Windows internals (including memory usage, context, threads, and processes), review additional resources, such as Windows Internals by Mark Russinovich, David Solomon, and Alex Ionescu.

Feedback

Submit and view feedback for

Skip to main content

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

tasklist

• Article
• 03/03/2021
• 3 minutes to read

In this article

Displays a list of currently running processes on the local computer or on a remote computer. Tasklist replaces the tlist tool.

Note

This command replaces the tlist tool.

Syntax

tasklist [/s [/u [\] [/p ]]] [{/m | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi [/fi [ ... ]]]

Parameters

Parameter	Description
/s	Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u \	Runs the command with the account permissions of the user who is specified by or by \. The /u parameter can be specified only if /s is also specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command.
/p	Specifies the password of the user account that is specified in the /u parameter.
/m	Lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task.
svc	Lists all the service information for each process without truncation. Valid when the /fo parameter is set to table.
/v	Displays verbose task information in the output. For complete verbose output without truncation, use /v and /svc together.
/fo {table | list | csv}	Specifies the format to use for the output. Valid values are table, list, and csv. The default format for output is table.
/nh	Suppresses column headers in the output. Valid when the /fo parameter is set to table or csv.
/fi	Specifies the types of processes to include in or exclude from the query. You can use more than one filter or use the wildcard character (\) to specify all tasks or image names. The valid filters are listed in the Filter names, operators, and values section of this article.
/?	Displays help at the command prompt.

Filter names, operators, and values

Filter Name	Valid Operators	Valid Value(s)
STATUS	eq, ne	RUNNING | NOT RESPONDING | UNKNOWN. This filter isn't supported if you specify a remote system.
IMAGENAME	eq, ne	Image name
PID	eq, ne, gt, lt, ge, le	PID value
SESSION	eq, ne, gt, lt, ge, le	Session number
SESSIONNAME	eq, ne	Session name
CPUtime	eq, ne, gt, lt, ge, le	CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number
MEMUSAGE	eq, ne, gt, lt, ge, le	Memory usage in KB
USERNAME	eq, ne	Any valid user name ( or )
SERVICES	eq, ne	Service name
WINDOWTITLE	eq, ne	Window title. This filter isn't supported if you specify a remote system.
MODULES	eq, ne	DLL name

Examples

To list all tasks with a process ID greater than 1000, and display them in csv format, type:

tasklist /v /fi "PID gt 1000" /fo csv

To list the system processes that are currently running, type:

tasklist /fi "USERNAME ne NT AUTHORITY\SYSTEM" /fi "STATUS eq running"

To list detailed information for all processes that are currently running, type:

tasklist /v /fi "STATUS eq running"

To list all the service information for processes on the remote computer srvmain, which has a DLL name beginning with ntdll, type:

tasklist /s srvmain /svc /fi "MODULES eq ntdll*"

To list the processes on the remote computer srvmain, using the credentials of your currently logged-on user account, type:

tasklist /s srvmain

To list the processes on the remote computer srvmain, using the credentials of the user account Hiropln, type:

tasklist /s srvmain /u maindom\hiropln /p p@ssW23

Additional References

• Command-Line Syntax Key

Feedback

Submit and view feedback for

Which command tells you who is currently logged on to the system?

Users command is used to print the user name who are all currently logged in the current host. It is one of the command don't have any option other than help and version.

What command is used to show who is currently logged in and what they are doing?

The w command shows who is logged in to the system and what they are doing.

What is the command to determine the current user logged in Linux?

The best Linux command to check the logged-in users is using w command. All we need is to open the terminal then type w in the prompt. This command shows who's logged in and what they are doing. It displays information about current users on the machine by reading the file /var/run/utmp, and their processes from /proc.