Viewing the Process Tree - tlist/tasklist [closed]

Question

Starting with windows xp, the tlist command was replaced by the tasklist command.

The old tlist command had the option \t, which permitted to query parent/child process relationship.

Does a similar option exist in tasklist?

Thank you

Pensile

I truly HATE and DESPISE vague and generic "this question is closed" - I wish someone would explain what the problem with the question is. Anyways, yes, there turns out to be a tool that allows for viewing the process tree from the command line: PsList - Windows Sysinternals, or for me pslist64.exe -t. – Calash

Answer 1

I think you want this:

tasklist /SVC

If this is not helpful then I recommend Process Explorer. It is a program which shows all parent and child processes.

This is the official link: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Correll

tasklist /SVC doesn't give the process tree. It just gives names of associated services. Process Explorer is the way to go. – Scrivings

does process explorer has the command line mode? – Berhley

Process Explorer, very nice! – Gaza

Answer 2

Also you can tried

tasklist /M

It will give you result like that:

BESClientUI.exe               4296 ntdll.dll, wow64.dll, wow64win.dll,
                                   wow64cpu.dll
SynTPHelper.exe               2216 N/A
sihost.exe                    9340 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
                                   msvcrt.dll, combase.dll, ucrtbase.dll,
                                   RPCRT4.dll, bcryptPrimitives.dll,
                                   sechost.dll, advapi32.dll,
                                   CoreMessaging.dll, ntmarta.dll,

Also you can filter it

tasklist /M /FI "xxx"

Where as xxx you can specyfi filter parameters

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING | SUSPENDED
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

for example:

tasklist /M /FI "IMAGENAME eq explorer.exe"

Which give's you somethin similar:

Image Name                     PID Modules
========================= ======== ============================================
explorer.exe                  9912 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
                                   msvcrt.dll, combase.dll, ucrtbase.dll,
                                   RPCRT4.dll, bcryptPrimitives.dll,
                                   OLEAUT32.dll, msvcp_win.dll, shcore.dll,
                                   advapi32.dll, sechost.dll, powrprof.dll,
                                   user32.dll, win32u.dll, GDI32.dll,
                                   gdi32full.dll, shlwapi.dll,
                                   windows.storage.dll, kernel.appcore.dll,
                                   profapi.dll, FLTLIB.DLL, SHELL32.dll,
                                   cfgmgr32.dll, TWINAPI.dll, PROPSYS.dll,
                                   winmm.dll, settingsynccore.dll,
                                   UxTheme.dll, dwmapi.dll, SspiCli.dll,
                                   USERENV.dll, twinapi.appcore.dll,
                                   WININET.dll, WTSAPI32.dll,
                                   TextInputFramework.dll, WINMMBASE.dll,
                                   bcrypt.dll, cryptsp.dll, RMCLIENT.dll,
                                   CoreUIComponents.dll, CoreMessaging.dll,
                                   wintypes.dll, ntmarta.dll, IMM32.DLL,

Satinwood