Recipe 10.1. Viewing the Running Processes

Problem

You want to see all processes that are currently running on a system.

Solution

Using a graphical user interface

1. Open the Windows Task Manager (taskmgr.exe).

2. Click on the Processes tab.

Using a command-line interface

Use tasklist.exe to view all processes (use the /S option to target a remote system):

> tasklist

tasklist has several options for searching processes. This command searches for all iexplore (Internet Explorer) processes being run by the Administrator user:

> tasklist /FI "IMAGENAME eq iexplore*"  /FI "USERNAME eq Administrator"

You can also use tasklist to perform searches based on PID, memory usage, CPU time, and other attributes. This command finds all processes running on host dhcp01 that are consuming more than 10 MB of memory:

> tasklist /S dhcp01 /FI "MEMUSAGE gt 10240

Another Windows XP tool you can use to get a process list is wmic as shown here (use the /node: option to target a remote system):

> wmic process list brief

Using downloadable software

The Sysinternals Process Explorer (procexp.exe) tool can be used to view and search for processes. Sysinternals also has a command-line tool called pslist.exe that can list processes.

Using VBScript

' This code displays the running processes on the target computer. ' ------ SCRIPT CONFIGURATION ------ strComputer = "."  ' Can be a hostname or "." to target local host ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") set colProcesses = objWMI.InstancesOf("Win32_Process") for each objProcess In colProcesses     WScript.Echo objProcess.Name & " (" & objProcess.ProcessID & ")" next ' This code finds the processes that have a memory usage greater ' than the specified amount.  To search on different criteria, ' modify the WQL used in the ExecQuery call. ' ------ SCRIPT CONFIGURATION ------ strComputer = "." intMaxMemKB = 1024 * 10000 ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") set colProcesses = objWMI.ExecQuery("Select * from Win32_Process " & _                                     " Where workingsetsize > " & intMaxMemKB ) WScript.Echo "Process, Size (in KB)" for each objProcess in colProcesses    WScript.Echo objProcess.Name & ", " & objProcess.WorkingSetSize / 1024 next

Discussion

Sometimes it is difficult to associate an application (e.g., Internet Explorer) with its underlying process (e.g., iexpore.exe). In each of the command-line solutions, only the process name will be shown, and it may be completely different from the name of the application. With Internet Explorer, it is pretty easy to figure out that iexplore.exe is probably the underlying process, but how can you tell for sure? One way is to look at Sysinternals Process Explorer. It displays a Description field that contains the application name of the process. Alternatively, you can specify the /v option with the tasklist command, which displays a Window Title field for each process. This typically includes the name of the application. Here is an example command you can run:

> tasklist /v /fo list

Unfortunately, you can't programmatically retrieve the Window Title using the Win32_Process class.