Process Explorer v16.32

By Mark Russinovich

Published: April 28, 2020

Download Process Explorer (2.5 MB)
Run now from Sysinternals Live.

Introduction

Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.

The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.

The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.

Related Links

• Windows Internals Book The official updates and errata page for the definitive book on Windows internals, by Mark Russinovich and David Solomon.
• Windows Sysinternals Administrator’s Reference The official guide to the Sysinternals utilities by Mark Russinovich and Aaron Margosis, including descriptions of all the tools, their features, how to use them for troubleshooting, and example real-world cases of their use.

Download

Download Process Explorer (2.5 MB)
Run now from Sysinternals Live.

Runs on:

• Client: Windows Vista and higher (Including IA64).
• Server: Windows Server 2008 and higher (Including IA64).

Installation

Simply run Process Explorer (procexp.exe).

The help file describes Process Explorer operation and usage. If you have problems or questions please visit the Process Explorer forum on Technet.

Note on use of symbols

When you configure the path to DBGHELP.DLL and the symbol path uses the symbol server, the location of DBGHELP.DLL also has to contain the SYMSRV.DLL supporting the server paths used. See SymSrv documentation or more information on how to use symbol servers.

Learn More

Here are some other handle and DLL viewing tools and information available at Sysinternals:

• The case of the Unexplained. In this video, Mark describes how he has solved seemingly unsolvable system and application problems on Windows.
• Handle — a command-line handle viewer
• ListDLLs — a command-line DLL viewer
• PsList — local/remote command-line process lister
• PsKill — local/remote command-line process killer
• Defrag Tools: #2 — Process Explorer In this episode of Defrag Tools, Andrew Richards and Larry Larsen show how to use Process Explorer to view the details of processes, both at a point in time and historically.
• Windows Sysinternals Primer: Process Explorer, Process Monitor and More Process Explorer gets a lot of attention in the first Sysinternals Primer delivered by Aaron Margosis and Tim Reckmeyer at TechEd 2010.

—>

Remote Process Viewer

Remote Process Viewer will offer you the possibility to manage the Windows tasks remotely. Download Remote Process Viewer on your computer for free today!

To comfortably view all the applications that are currently running on a computer at a specific moment in time, we can use Remote Process Viewer, a practical free application the is capable of monitoring all the processes that are currently running on any computer on a network.

Remote Process Viewer works without having to be installed. It is very easy to use. Once installed, select the computer from the drop-down menu, called «Computer«, and press «Scan Now!«.

In a matter of seconds, we will have access to all the processes that are running on that computer. If you want to check information about any of them, all you have to do is select it and double click on it. A browser window will open with the information we were looking for.

What’s more, Remote Process Viewer provides the following information:
— Name of the process and folder where it can be found.
— Process ID.
— Memory use.
— Time it has been running for.
— Session, handles and threads.

Download this free application and make the most of all its features.

Remote Process Viewer

Review

Free Download

specifications

changelog

Tiny and portable software application that shows detailed information for all running processes on a remote computer, using low resources

Remote Process Viewer is a speedy, small and portable utility designed for network administrators who want to analyze process information on remote computers. It features a few options that are intuitive enough to be figured out by anyone, even by those with minimal background in networking utilities.

Portability advantages

As there is no setup kit involved, you can save the executable file to any part of the hard disk and just click it to run, as well as copy it to a USB flash disk or similar storage unit, in order to run it on any PC seamlessly, without previously installing anything.

An important aspect worth taking into account is that the Windows registry does not get updated with new entries, and no extra files are created on the disk, leaving it clean after removal.

Familiar interface and intuitive features

The primary window has a clear-cut structure. Remote Process Viewer does not put too much emphasis on its visual appeal, letting users immediately dive into the configuration instead.

View process information remotely

All you have to do is specify the remote computer’s name, along with user name and password (if any), in order to grant access to your PC and scan the active processes. Scan results show the name, full path, ID, RAM usage, CPU time, total handles, session count, total threads, and priority level for each process. In addition, you can look up any item on Google.

There are no other notable options available here. Unfortunately, Remote Process Viewer does not implement options for copying data to the Clipboard, exporting it to file, or printing it for closer examination.

Evaluation and conclusion

The tool popped up several errors during our evaluation, preventing us from connecting to other PCs in our network. However, it has a good response time and minimal impact on computer performance. All in all, Remote Process Viewer offers a simple solution when it comes to studying process details on other LAN PCs remotely.

5 Ways to Kill and View Processes on a Remote Computer

One of the first things any knowledgeable user would do if they suspect there is something slowing their computer down or a suspected malicious program might be running in the background, is press Ctrl+Shift+Escape to open the Windows Task Manager. From there you can view what’s running and detect if any programs are using too much CPU time or memory, or look suspect and shouldn’t be there. Although the Windows Task Manager is a valuable tool, there are better alternative Task management tools out there that you can use to replace it with.

Using the built in tool to manage tasks or a third party task manager on your local computer is great, but what about if you have more than one computer in your network to keep an eye on? Process Explorer, Process Hacker or System Explorer etc cannot show you what’s running on another computer so ordinarily if there is something that needs checking, you would have to go to that computer physically and view or kill any processes.

Thankfully there are ways to access other computers in your local network remotely, and you can also view and manipulate processes on another computer without leaving your own. Here we show you 5 ways to view and manage another computer’s tasks remotely.

Remote Process Explorer by Lizardsystems is a well known free application to view and manipulate the running processes on a remote computer. It is completely free for home and non commercial use. You do need a free registration code to use the free version though, visit the Registration page and enter your name, e-mail, city and country. Once you get the code in your inbox, enter it via Help > Enter Registration Code.

Although it runs through Windows Management Instrumentation (WMI), Remote Process Explorer is quite comprehensive in what it displays and what you can do. Apart from viewing very detailed information of each remote process, you can kill, run and also change the priority of a remote process. You can even tick a box and have the related process log its memory and CPU usage via a graph in the main window

On first launch the program will ask to run the Wizard which will detect what computers are on the network, or you can go straight to the main interface and configure things yourself. Assuming you have run the Wizard and it’s detected the target computer, right click on it in the computers list to the left > Connect as > The following user, then enter the remote username and password and click OK.

The Processes and OSInfo tabs should now be populated with the information from the remote computer. Remote Process Explorer also has some administrative tools for remote management. You can shutdown, explore, open the Computer or Services Management consoles, open Event Viewer, open a Remote Desktop session or send a message etc.

Although Remote Process Explorer isn’t portable you can extract the setup installer with Universal Extractor and save the contents of the folder to turn it into a portable version.

2. Desktop Central Free Windows Tools

ManageEngine make a number of commercial software applications for remote operations, corporate networking and enterprise solutions. They also have an application suite called Desktop Central which is designed for large networks but a free version has been made available that contains a number of individual components from the main suite.

There is a total of 12 tools in the Free suite, including Software Inventory to get a remote list of installed software, Wake on LAN, Remote Command Prompt, Remote Shutdown and Restart tool, Hard Disk Space detector, Laptop Battery Power Monitor and what we’re looking for here, Remote Task Manager.

Although basic, the Remote Task Manager is able to show you a list of processes running on the remote machine and allows you to kill a process in the list. Simply enter your remote user’s name and password into the boxes, then add the remote computer name or IP into both the Domain Name and Computer Name boxes, finally click the Get Process button.

The window will then populate itself with the list of processes on the remote machine, hovering over a process will select it, clicking “End Process” will allow you to terminate whatever process is highlighted. The icons above are to refresh the list and choose extra columns of information. Although you need to initially install Free Windows Tools to run the Remote Task manager, you can copy RemoteTaskManager.exe from the Program files folder and use it as a portable tool, then uninstall the suite again.

3. Remote Process Viewer

Remote Process Viewer is a very simple program that gives you a list of all the processes currently running on a remote computer. A useful bonus is it’s also a standalone portable executable of around 600KB that doesn’t need installation although if you want to do more than just view what’s running on the target computer you will need to use something else a bit more powerful.

Because it uses WMI to gather it’s information, you will need to make sure WMI is allowed through your firewall (see below). Then all you have to do is supply the name or IP address of the remote computer, or use the Browse button to find the computer on the network, than supply the username and password of the logged on remote user, finally click “Scan Now”.

After a few seconds the main window should be populated with Process name, it’s folder, ID, used memory, CPU time, priority and a few other related pieces of information. Clicking on a process will allow you to search for that particular process name via File.net and the Google button. The popup isn’t useful and only points to a shareware network task manager trial.

4. Yet Another (Remote) Process Monitor

Also known as YAPM, this is quite a feature rich program and in addition to being able to view processes on the local or remote computer, it can also perform a number of other remote functions. These include killing existing or opening new processes, starting, stopping, creating or disabling services, viewing and closing remote network connections, and the ability to show, maximize/minimize or end currently opened tasks.

YAPM has two main modes of remote operation; Connecting via Windows Management Instrumentation (WMI) or using the YAPM server. Using WMI is a lot easier and requires nothing extra apart from making sure the connection to the remote machine works. It does have a drawback though of not allowing as many functions like tasks management, monitoring and network management.

The YAPM server allows for all the remote functions available in the program but YAPM itself needs to be run on the remote machine in server mode for it to work, something which you may not be able to do. Unless you need the extra functions of the YAPM server it’s recommended to start with WMI mode.

To set up for WMI, launch the program and click the round Settings button > Change Connection type. Click “Remote via WMI”, enter the remote computer name or IP address, the username and the password, then click Disconnect and the same button again to connect to the remote machine. This will populate the relevant YAPM windows with processes and services where you can view, start, stop and gather information about each item. It also has a portable version.

5. Remotely Viewing and Killing Tasks From Command Prompt

Windows has several built in command line utilities for performing various tasks, and two tools which are useful for this job are “Tasklist” and “Taskkill”. If you open an admin command prompt (Press Start, type cmd, press Ctrl+Shift+Enter) and type tasklist, it will give you a list of running processes on your computer. It can however, be used to get the task list from a remote computer with a few extra arguments, they are:

Tasklist /S remote system (name or IP address) /U username /P password

Make sure to put anything in quotes that has a space in the name. This will give you a list of remote process names running on the target computer along with their Process IDentifier (PID) and memory usage. Killing a process in the list is achieved with the taskkill command that has a similar syntax to tasklist:

Taskkill /S remote system /U username /P password /IM Process

Simply add the process name (including .exe) or the PID number you wish to kill along with the “/IM” argument after the computer name, username and password. If it works a SUCCESS message will show. If the process doesn’t get killed, try and add /F to the end of the line to force the process to be terminated. Obviously some processes cannot be terminated such as those which are system critical or security software etc.

Requirements to Enable Remote Process Viewing and Control

Unless you have enabled your system to view processes remotely before, there are some requirements that must be met in order for tools like these to work in a local area network .

Note: If you have a Windows Home or Basic edition such as XP Home, Vista / 7 Basic or Home Premium, remote administration is disabled on those versions so it’s not possible to view or control processes on another computer. You can however, connect to those versions from a Professional, Enterprise or Ultimate version of Windows.

– You must be an Administrator or have Admin privileges to connect to the remote machine.

– Make sure the computer you are connecting to has a password on its user account, blank passwords will NOT work. Go to Control Panel > User Accounts > Create a password for the user if necessary.

– Make sure simple file sharing is disabled in Windows XP. Go to Control Panel > Folder Options > View tab > Scroll right to the bottom at Advanced Settings > Uncheck “Use simple file sharing”.

– Make sure a file and printer sharing exception is allowed in the firewall, go to Start > Run > and type:

netsh firewall set service type = FILEANDPRINT mode = enable

– With programs that use Windows Management Instrumentation (WMI) to gather the remote computer’s data, you need to make sure WMI is allowed through any active firewall. An RPC server error is common if WMI is being blocked by a firewall. For third party firewalls, TCP port 135 needs allowing. For Windows Firewall, type the following command into an admin Command Prompt for Vista, 7 and 8:

netsh advfirewall firewall set rule group="e;windows management instrumentation (wmi)"e; new enable=yes

Or alternatively go to Windows Firewall in Control Panel, click “Allow a program or feature through Windows Firewall” and tick “Windows Management Instrumentation (WMI)”. Click OK.

For Windows XP Firewall use:

netsh firewall set service RemoteAdmin enable

If you still have issues of not being able to connect to the remote computer, you may need to temporarily disable any firewall or other security software and then try to connect.