Windows commands

tasklist and taskkill: see and stop running programs

Every running program is a process. tasklist shows the processes and taskkill ends one. Together they do what Task Manager does, from the keyboard, and they can be used in scripts.

These commands were not run for this page, since the list would describe a real computer. The sample output is an illustration.

tasklist

tasklist

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0      2,140 K
explorer.exe                  6120 Console                    1    142,560 K
notepad.exe                   9344 Console                    1     14,208 K
chrome.exe                   10288 Console                    1    210,032 K

• Image Name is the program file.
• PID is the process ID, a number that identifies one running copy. A program with several windows or tabs may appear many times, each with its own PID.
• Mem Usage is the memory in use.

The list is long. To find one program, filter it:

tasklist | findstr /i notepad
tasklist /fi "imagename eq notepad.exe"
tasklist /fi "memusage gt 500000"

The first uses findstr on the output. The second uses tasklist's own filter. The third shows processes using more than about 500 MB.

tasklist /svc shows which Windows services run inside each process, and tasklist /v adds the window title and the user.

taskkill: ending a process

By name:

taskkill /im notepad.exe

By PID, to end one particular copy:

taskkill /pid 9344

Without further options, taskkill asks the program to close, as if you had clicked its close button. A healthy program gets the chance to offer "Save changes?".

Forcing it

A frozen program cannot answer a polite request. /f ends it at once.

taskkill /f /im notepad.exe

Danger. /f gives the program no chance to save. Any unsaved work in it is lost. Use it only on a program that is truly not responding, after waiting a reasonable time.

/t also ends the processes that the program started, its "tree". It is needed for programs that launch helpers.

End every program that has stopped responding:

taskkill /f /fi "status eq not responding"

What not to end

Danger. Do not end processes you do not recognise. Many belong to Windows, and ending some of them, such as csrss.exe, wininit.exe, winlogon.exe or lsass.exe, crashes or restarts the computer at once. svchost.exe appears many times and runs essential services. If a name is unfamiliar, look it up before touching it.

Ending explorer.exe makes the taskbar and desktop vanish. That one is recoverable: run start explorer.exe from the Command Prompt, or use File, Run new task in Task Manager.

"Access is denied"

Some processes belong to Windows or to another user. To end those, the Command Prompt must be opened as administrator: search for cmd, right-click it and choose Run as administrator. Think twice. If Windows protects a process, there is usually a reason.

Task Manager does the same

Ctrl + Shift + Esc opens Task Manager, where the same list has a search box and an End task button. For a single frozen program it is the easier route. The commands earn their place when Task Manager itself will not open, when the mouse is unusable, when working on another computer remotely, or inside a script.

Finding what is slowing the computer

tasklist shows memory, not processor use. For that, Task Manager's Processes tab, sorted by CPU, is clearer. From the command line, PowerShell's Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 lists the ten heaviest.

On Linux and the Mac, see ps, top and kill.

Examples shown with output were run on 12 November 2026 in a practice folder: Windows commands in cmd.exe on Windows 11, Linux commands with the GNU tools of Git Bash. The folder path and user name were replaced with made-up ones. Commands marked "not run here" are shown as you would type them.

This is an independent learning site. It is not connected with Microsoft, Apple or any Linux distribution. Windows, macOS and other names belong to their owners. Try commands first in a practice folder, never on files you cannot afford to lose.