Q. How can I determine the command-line that started a process?

To display the list of processes, Windows 2000 uses Tlist.exe from the Windows 2000 Support Tools. Windows XP, Windows Server 2003, and newer operating systems use TaskLIst.exe, which is installed with the operating system.

NOTE: See tip 7187 » How do I determine the proper task list utility to run?

The Tlist.exe program has the ability to display the command-line used to start a process. For example, if one of the lines returned by running tlist in a CMD.EXE window is:

4692 notepad.exe       NewTips.txt - Notepad

then running tlist NewTips* returns:

4692 notepad.exe       NewTips.txt - Notepad
   CWD:     C:   CmdLine: notepad.exe  "C:\Documents and Settings\Jerry\My Documents\WEB\NewTips.txt"
   VirtualSize:    29700 KB   PeakVirtualSize:    36456 KB
   WorkingSetSize:  1812 KB   PeakWorkingSetSize:  3620 KB
   NumberOfThreads: 1
   4696 Win32StartAddr:0x0100739d LastErr:0x00000000 State:Waiting
  5.1.2600.2180 shp  0x01000000  notepad.exe
  5.1.2600.2180 shp  0x7c900000  ntdll.dll
  5.1.2600.2945 shp  0x7c800000  kernel32.dll
  . . . . . . . snip . . . . . . .

If I run tasklist /FI "WindowTitle eq NewTips*", I receive:

Image Name                   PID Session Name     Session#    Mem Usage
==================== 
= =========== 
 =========
notepad.exe                 4692 Console                 0      1,848 K

If I run tasklist /FI "WindowTitle eq NewTips*" /V, I receive:

Image Name           PID  Session Name  Session#   Mem Usage Status   User Name      CPU Time Window Title
notepad.exe          4692 Console              0     1,848 K Running  JSIINC\Jerry   0:00:02  NewTips.txt - Notepad

Since TaskList.exe doesn't display the command-line used to start a process, install Tlist.exe on Windows XP, Windows Server 2003, and later computers:

1. Insert the Windows 2000 CD-ROM in the CD-ROM reader.

2. When prompted about an older version of the operating system, press OK.

3. Browse to Support and Tools.

4. Extract tlist.exe from the Support.cab file. Save it in a folder that is in your PATH.

Comments

Plain text