Tasklist command

In Windows, we can get the list of processes running on the system from command prompt also. We can use ‘tasklist‘ command for this purpose.
Using this command we can selectively list the processes based on criteria like the memory space used, running time, image file name, services running in the process etc. Below you can find the syntax and examples for various cases.

Get the list of all the process running on the system

tasklist

Get the list of process using memory space greater than certain value.

tasklist /fi "memusage gt memorysize"

Memory size should be specified in KB
For example, to get the list of processes occupying more than 30MB of memory, we can run the below command.

tasklist /fi "memusage gt 30000"

Find the list of processes launched by a user

tasklist /fi "username eq userName"

Find the memory usage of a specific process

tasklist /fi "pid eq processId"

Example:

c:\>tasklist /fi "pid eq 6544"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
WmiPrvSE.exe                  6544 Services                   0      8,936 K

Find the list of not responding processes

tasklist /fi "status eq not responding"

example:

c:\>tasklist /fi "status eq not responding"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
rundll32.exe                  3916 Console                    1      7,028 K

Get the list of services running in a process

tasklist /svc /fi "pid eq processId"

Example:

c:\>tasklist /svc /fi "pid eq 624"
Image Name                     PID Services
========================= ======== ============================================
lsass.exe                      624 EFS, KeyIso, Netlogon, ProtectedStorage,
                                   SamSs, VaultSvc
c:\>

Get list of processes running for more than certain time

tasklist /fi "cputime gt hh:mm:ss"

example:
Get the list of processes that have been running from more than an hour and 20 minutes.

c:\>tasklist /fi "cputime gt 01:20:00"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
SynTPEnh.exe                  4152 Console                    1      8,080 K
firefox.exe                   1740 Console                    1    857,536 K
c:\>

Find processes that are running a specified image file:

tasklist /fi "imagename eq imageName"

Example:

c:\>tasklist /fi "imagename eq firefox.exe"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
firefox.exe                   1740 Console                    1    812,160 K
c:\>

Find the process running a specific service

tasklist /fi "services eq serviceName"

example:

c:\>tasklist /fi "services eq webclient"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
svchost.exe                   1052 Services                   0     20,204 K
c:\>

Related Posts:
How to kill a process from windows command line.