View and stop tasks running on a Windows PC without using Task Manager

Overview

The following commands will allow you to view what tasks are running on a Windows PC without using Task Manager or a Linux machine (such as MobaXTerm).

A second set of commands will allow to you to stop any selected task.

This covers some of the many options available with the commands:

tasklist, taskkill, wmic

tasklist

The tasklist command  is similar to "ps" command on Linux and is used to see the details of the programs and processes that are running in Windows. Tasklist can be applied to see how much memory and CPU time running processes are using, what DLL files they rely on, and other information.  Thus it can be a very useful troubleshooting tool.

From a cmd window, type "tasklist"

• Processes info: When you enter tasklist on the command prompt, you can see the following informations by default. Image Name, PID, Session Name, Session#, Mem Usage
• Processes detailed info: Additional info like, Status, User Name, CPU Time, Window Title can be displayed using tasklist /v
• Services and Processes info: Use tasklist /svc to get a table relating Image Name, PID, and Services, very useful to know the relationship between a process and the services that are running on a system.
• dlls and Processes info: Tasks and Use tasklist /m to find which DLLs are used by each process.
• Filtering processes: Processes can be filtered using ImageName, PID, MemUsage, Status, Username and WindowTitle. For example:
  • Use the following command to to find processes that are not responding.
    • tasklist /fi "status eq not responding"
  • Use the folliwing to list the processes eating up more than 10MB.
    • tasklist /fi "memusage gt 10000"

taskkill

The taskkill command is used to end a process.  Apart from specifying the PID or the image name of the process to kill, we can also use certain filters to kill the matching processes as explained below.

• Kill with name: Use taskkill /im imagename to kill a process with the given Image name. For example:
  • taskkill /im notepad.exe /f (forces notepad to be killed.)
• Kill with PID : Use taskill /pid <processid> to kill a process with the given processid (taskkill /pid 1479)
• Filtering Taskkill: Processes to be killed can be filtered using ImageName, PID, MemUsage, CPUTime, Session, Status, Username, WindowTitle, Services or Modules (dll). For example:
  • Use the following command to forcefully shut down all the processes that are not responding.
    • taskkill /f /fi "status eq not responding"
  • Use the folliwing to close down all programs using more than 10 MB..
    • taskkill /f /fi "memusage gt 10000"
• More Info: To get more info on advanced syntax of the command use taskkill /? or refer to Microsoft’s documentation.

wmic

• Using the Windows Management Instrumentation Command-line (WMIC) tool you can find out some good information. For example, you can use this command to find out when a server was last rebooted.
• Simply open a command prompt and type:
• wmic os get lastbootuptime

You can find other useful command for the wmic tool with a simple Internet search.  One such useful link is https://blogs.technet.microsoft.com/...-wmic-queries/