Working with processes from the command line isn't such a rare need. This covers working with processes on the local machine, but — far more important and useful — also working with processes running on a remote machine.
Viewing processesThe "tasklist" command handles this:
C:\> tasklist
It outputs a list of processes, showing the name, PID, session, and memory usage of each process.
You can list processes on a remote computer:
C:\> tasklist /S \\192.168.0.1 /U DOMAIN\admin /P
Here, instead of "192.168.0.1" substitute the IP address or name of the remote computer you need, and instead of "DOMAIN\admin" substitute the username of an account with administrative rights on the remote computer.
The command also supports filters. You can read about them in the help. Here's an example of a filter that looks for all processes named "soffice.bin":
C:\> tasklist /FI "IMAGENAME eq soffice.bin"
Killing processesThe second part of working with processes in this reminder note is terminating processes, especially on a remote computer — virus processes, for example.
This is handled by the "taskkill" command, which essentially has syntax similar to "tasklist".
This command can kill processes by process name, by PID, or by a filter.
Here's how we terminate the process with PID 999:
C:\> taskkill /PID 999
And here's how — all processes named "soffice.bin":
C:\> taskkill /IM soffice.bin
or — all processes whose name starts with "iproc", for example "iprocus", "iproc0", "iproc" and "iproc-111":
C:\> taskkill /IM iproc*
And finally, let's terminate all processes of user "justuser" named "soffice.bin":
C:\> taskkill /FI "USERNAME eq justuser" /IM soffice.bin
Like tasklist, the "killing" command can do all of this on a remote computer too. The syntax is the same as with the listing command:
C:\> taskkill /S \\192.168.0.1 /U DOMAIN\adminuser /P /PID 999
And, as always, full information is in the help. Here — just a "nudge" in the direction of this topic.
Comments