NW Doc

TaskList displays all running applications and services with their Process ID (PID) This can be run on either a local or a remote computer.

Syntax
      tasklist options

Options:

   /s computer  Name or IP address of a remote computer
                don't use backslashes. Default = local computer.

   /u domain\user [/p password]]
                Run under a different account

   /svc         List information for each process without truncation.
                Valid when /fo=TABLE. Cannot be used with /m or /v

   /m [ModuleName]
                Show the processes that include the given module.

   /v           Verbose task information

   /fo {TABLE|LIST|CSV}]
                Output format, the default is TABLE.

   /nh          No Headers in the output (does not apply to LIST output)

   /fi FilterName [/fi FilterName2 [ ... ]]
                Apply one of the Filters below:

                   Imagename   eq, ne                  String
                   PID         eq, ne, gt, lt, ge, le  Positive integer.
                   Session     eq, ne, gt, lt, ge, le  Any valid session number.
                   SessionName eq, ne                  String
                   Status      eq, ne                  RUNNING | NOT RESPONDING
                   CPUTime     eq, ne, gt, lt, ge, le  Time hh:mm:ss
                   MemUsage    eq, ne, gt, lt, ge, le  Any valid integer.
                   Username    eq, ne                  User name ([Domain\]User).
                   Services    eq, ne                  String
                   Windowtitle eq, ne                  String
                   Modules     eq, ne                  String

Examples:

List the services running under each process:

TASKLIST /svc

List the services running under each SvcHost process:

TASKLIST /FI "imagename eq svchost.exe" /svc

List the services running now:

TASKLIST /v /fi "STATUS eq running"

List the services running under a specific user account:

TASKLIST /v /fi "username eq SERVICE_ACCT05"