Command Reference

tasklist

Command Prompt Networking Beginner Risk: Low
Back to Command Library

Summary

Displays running processes on local or remote Windows systems, with options to filter, format, and show modules, services, and verbose details.

Syntax 

TASKLIST [/S system [/U [domain\]user [/P [password]]]] [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Examples 

tasklist

Lists all running processes on the local computer in a table. 

tasklist /v /fi "status eq not responding"

Shows verbose details for processes that are not responding. 

tasklist /fi "imagename eq chrome.exe"

Lists only processes whose image name matches chrome.exe. 

tasklist /fi "memusage gt 500000" /fo csv /nh

Outputs, in CSV without headers, processes using more than ~500,000 KB of memory. 

tasklist /svc /fi "imagename eq svchost.exe"

Shows which services are hosted by each svchost.exe instance. 

tasklist /m ntdll.dll

Lists processes that have loaded ntdll.dll (and shows loaded modules). 

tasklist /s SRV01 /u CONTOSO\Admin /p

Prompts for the password and lists processes on remote host SRV01 using the specified credentials.

Permissions

Administrator required: No

Local use typically works as a standard user. Remote use (/S) generally requires local administrator rights on the target, proper credentials (/U, /P), network connectivity, and firewall allowance for RPC. UAC remote restrictions may block administrative local accounts unless using the built-in Administrator or appropriate policy settings.

Risk and Impact

Risk level: Low

Changes the system: No

tasklist is read-only, but frequent remote enumerations can add minor overhead and will create authentication and audit log entries.

Supported Platforms

Windows 10 Windows 11 Windows Server

Important Output Fields

IMAGENAME

Executable name of the process; use to identify the application (e.g., chrome.exe, svchost.exe).

PID

Unique process identifier; essential for correlating logs and for targeted termination with taskkill.

MEMUSAGE

Approximate working set in KB; high values can indicate memory leaks or runaway processes.

STATUS

Indicates RUNNING, NOT RESPONDING, or UNKNOWN; helps quickly spot hung apps.

USERNAME

Account under which the process runs; useful for security context and ownership checks.

CPUTIME

Cumulative CPU time used; sustained high values can indicate CPU-bound processes.

SERVICES (with /svc)

Lists Windows services hosted in the process; critical for mapping svchost.exe instances to services.

MODULES (with /m or /m module.dll)

Shows loaded DLLs; useful for dependency and injection analysis.

SESSIONNAME and SESSION#

Terminal Services session information; helps identify interactive vs. service sessions.

WINDOWTITLE (with /v)

Top-level window title for GUI apps; helps match processes to visible windows.

Common Errors

INFO: No tasks are running which match the specified criteria.

Your /FI filter returned no results. The criteria may be too restrictive or misspelled.

ERROR: Access is denied.

Insufficient rights to enumerate processes (common on remote systems without administrative privileges or due to UAC/remote restrictions).

ERROR: The RPC server is unavailable.

Remote enumeration failed; the target may be offline, RPC blocked by firewall, or RPC service not available.

ERROR: The network path was not found.

Bad hostname/IP or name resolution/connectivity issue when using /S to query a remote system.

ERROR: Invalid argument/option - '/XY'.

A parameter or switch is misspelled or unsupported. Check TASKLIST /? for valid options.

Related Articles

These Gnojo articles use or explain this command.

Desktop Support Beginner

Reading Windows Performance in Task Manager

Task Manager provides a live view of the applications and Windows processes using processor, memory, disk, and network resources. The goal is to observe sustained patterns before making a change—not to end unfamiliar processes.

View Article

Official References

tasklist (Windows Commands)

Microsoft Learn · Official Documentation

Open Source