TASKLIST

Displays running tasks by process ID or name on a specified system.

TASKLIST [/S system [/U username [/P [password]]]] [/M [module] | /SVC | /APPS | /V] [/FI filter] [/FO format] [/NH]

Where:

• /S system - Specifies the remote system whose activities you want to display. If not specified, the local system will be assumed. If a remote system is specified, the STATUS and WINDOWTITLE filters will be ignored.
• /U username - Specifies the user account associated with the activities to display.
• /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
• /M [module] - Displays tasks that use the specified executable or dynamic library. If module is not specified, displays all loaded modules.
• /SVC - Displays the services associated with each process.
• /APPS - Displays Windows Store apps and their processes.
• /V - Enables verbose mode.
• /FI filter - Specifies a filter to consider a set of activities. You can specify the wildcardwildcard *. The following table lists the possible filters to use with this option:

  Left-hand operand	Possible operators	Possible right-hand operands
  STATUS	EQ, NE	RUNNING, SUSPENDED, NOT RESPONDING, UNKNOWN
  IMAGENAME	EQ, NE	image_name
  PID	EQ, NE, GT, LT, GE, LE	process_id
  SESSION	EQ, NE, GT, LT, GE, LE	session_number
  SESSIONNAME	EQ, NE	session_name
  CPUTIME	EQ, NE, GT, LT, GE, LE	hh:mm:ss
  MEMUSAGE	EQ, NE, GT, LT, GE, LE	mem_in_kb
  USERNAME	EQ, NE	[domain\]user
  MODULES	EQ, NE	dll_name
  SERVICES	EQ, NE	service_name
  WINDOWTITLE	EQ, NE	window_title

• /FO format - Specifies the format for the output. format can be:
  • TABLE - table
  • LIST - list
  • CSV - CSV format, i.e. comma-separated values
• /NH - Specifies to exclude the header from the output. Valid only for TABLE and CSV formats.

Examples:

1. Display processes that use modules starting with wbem in list and verbose mode:

tasklist /m wbem* /fo list /v

 

2. Display processes with ID greater than or equal to 1000 with a title starting with Hello every in CSV format, excluding the header from the output:

tasklist /fi "pid ge 1000" /fi "windowtitle eq Hello every*" /fo csv /nh

 

3. Display processes with an image name starting with culardo on the remote system myneighbor for user luser with password passwrod:

tasklist /s myneighbor /u luser /p passwrod /fi "imagename eq culardo*"