TASKLIST [/S system [/U username [/P [password]]]] [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

This tool displays a list of currently running processes on either a local or remote machine.

/S system

Specifies the remote system to connect to.

/U [domain\]user

Specifies the user context under which the command should execute.

/P [password]

Specifies the password for the given user context. Prompts for input if omitted.

/M [module]

Lists all tasks currently using the given exe/dll name. If the module name is not specified all loaded modules are displayed.

/SVC

Displays services hosted in each process.

/V

Displays verbose task information.

/FI filter

Displays a set of tasks that match a given criteria specified by the filter.

/FO format

Specifies the output format. Valid values: “TABLE”, “LIST”, “CSV”.

/NH

Specifies that the “Column Header” should not be displayed in the output. Valid only for “TABLE” and “CSV” formats.

/?

Displays this help message.

Filters:

    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING |
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

NOTE: “WINDOWTITLE” and “STATUS” filters are not supported when querying a remote machine.

Examples:
TASKLIST
TASKLIST /M
TASKLIST /V /FO CSV
TASKLIST /SVC /FO LIST
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI “USERNAME ne NT AUTHORITY\SYSTEM” /FI “STATUS eq running”