137

I'm looking for a tool or method to find out what command line parameters have been passed to a program, for example when it was run by another program (launcher-application scenario).

1

8 Answers 8

98

You can do that using Process Explorer.

Just hover with your mouse over a process to see the command line arguments used to start it:
List of "chrome.exe" processes

Alternatively, you can open the properties of the process and inspect the command line right there:
Properties of a "chrome.exe" process

10
  • 2
    That's really cool.
    – cutrightjm
    Apr 22, 2012 at 15:23
  • 2
    Unfortunately, it doesn't seem to work with applications protected with WinLicense/Themida: oreans.com/winlicense.php Any other ideas?
    – Gepard
    Apr 22, 2012 at 16:24
  • @Gepard: How do you know it doesn't work? Are you sure the application was, in fact, called with command line arguments? Either way, PE uses the Windows way of determining that information. Anything else would have to be custom-tailored to a specific application, I assume. Apr 22, 2012 at 16:37
  • 8
    My bad, it didn't run PE elevated. It's working as intended.
    – Gepard
    Apr 22, 2012 at 16:46
  • @OliverSalzburg, How did this program work? Can any normal C program achieve this?
    – Pacerier
    Jan 20, 2015 at 3:17
127

You can do it without Process Explorer, too, using Windows' WMI service. Run the following from the command prompt:

WMIC path win32_process get Caption,Processid,Commandline

If you want to dump the output to a file (makes it a bit easier to read), use the /OUTPUT switch:

WMIC /OUTPUT:C:\Process.txt path win32_process get Caption,Processid,Commandline
9
  • 4
    @Pacerier: I'm not sure to be honest ;-) I think it came from digging around the WMI docs and playing around because I needed to use WMI for something at the time.
    – Andy E
    Jan 20, 2015 at 9:06
  • 3
    Which WMI docs are you referring to?
    – Pacerier
    Jan 22, 2015 at 3:48
  • 6
    This was a very helpful command line method for getting the command line of a running process. In my case, I was able to tweak this slightly to get output just for a specific process: WMIC path win32_process where "caption='cmd.exe'" get Commandline
    – chriv
    Mar 30, 2016 at 17:32
  • 4
    Great, and the where clause actually support some SQL features, e.g., where "name like 'cmd.%'
    – zhaorufei
    Aug 31, 2016 at 6:25
  • 4
    Here's an example of SQL like filtering in the where clause: WMIC path win32_process where "name like '%cmd%'" get Caption,Processid,Commandline
    – rleelr
    Nov 12, 2019 at 8:45
68

One can also achieve that by using Task Manager.

Open task manager (by CTRL-SHIFT-ESC, CTRL-ALT-DELETE or any other method).

For Windows 7 (and probably Windows XP):

  • Go to "Processes" tab. The on the "View" menu, select "Select Columns...".
  • Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)

For Windows 8:

  • Go to "Details" tab. Right-click on any of the columns (eg. Names, PID etc.) and select "Select columns".
  • Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)

A column of Command lines of will be added to the currently displayed columns.

11
  • 3
    I don't really get you @JesseBarnum, one can always resize the column to have a complete view no matter how long the command line is, right? Dec 7, 2015 at 0:35
  • 11
    This is a vastly underrated answer, had no idea this was possible. Mar 13, 2017 at 23:34
  • 8
    I see a couple of comments above about the Windows Task Manager. Even if you set the 'Command line' column to show a Java process with a really long command line will get truncated. BUT, you can click on the row in the Task Manager and 'copy' (Ctrl-c) the whole row and paste this into a text editor to see the whole command line, no matter how long.
    – JohnD
    Feb 21, 2018 at 2:43
  • 2
    Awesome! Had no idea that option was there. Now that I know I figured there's also a 'Command line' option to select when you right-click on the top-row under 'Processes' tab.
    – Neeraj
    May 1, 2018 at 13:11
  • 5
    I like this answer best. It works with a standard windows installation (including windows 10).
    – Stragulus
    Dec 8, 2018 at 16:04
12

PowerShell to the rescue.

Find:

Get-WmiObject Win32_Process -Filter "name = 'perl.exe'" | where {$_.CommandLine -eq '"C:\strawberry\perl\bin\perl.exe" t/Server_PreFork.t'}

And kill as bonus:

Get-WmiObject Win32_Process -Filter "name = 'perl.exe'" | where {$_.CommandLine -eq '"C:\strawberry\perl\bin\perl.exe" t/Server_PreFork.t'} | ForEach-Object { Invoke-WmiMethod -Path $_.__Path –Name Terminate }

You can run it from powershell directly or from a ps1 if you've got your system setup. I detail unrestricted script setup on i kill zombies with powershell as well as other powershell tricks...

2
  • 1
    Whoa... the kill part is quite dangerous, given the title of the question ;) Otheriwse a very neat answer ;)
    – Tom
    Aug 23, 2017 at 14:14
  • 1
    Perfect! Thanks for it. Astuce : You can use $._CommandLine -match "<any part of arg>" to filter process to kill
    – Chklang
    Jul 11, 2023 at 5:22
7

Previous answers are great in case the process is already running and is not going to terminate any soon. However If you need (as I did) to do this perhaps with processses start up multiple times and/or quickly terminate, or perhaps log occurences in a longer period of time, there is a way to this using Process Monitor.

Basically it logs various events in the system, in this case we can just filter the "Process Start" event and the name of the process we want to monitor, as shown below:

enter image description here

Then just keep the process monitor running and do whatever you do to get the process you want to log running. You can see in either the "Detail" column or the "Command line" column (depends on how you configure those) the command line arguments. For example:

enter image description here

Of course this way you can extract much more related information such as what is the working directory, what environment variables have been passed on the process, etc... Also it is easy to export the results into a file.

4

I know that OP have asked a question regarding Windows 7 and there are some great answers around.

I was facing this issue in windows 10 and I did not want to user ProcessExplorer or any utility but rather an easy way to get the command line arguments of an FFMPEG process that was initiated by a Video Converting tool. But the steps apply to any process that is run using command line arguments.

Here is what I did.

  1. Launch Task Manager >
  2. Identify Process >
  3. Right click the Process and click "Goto Process Details"
  4. Right click on any column and select "Show Columns" and then check "Command Line Arguments" option > Click OK.
  5. Then select the process you want the command line arguments for and then use Ctrl+C to copy all the data for that process (including the command line arguments)

Here are the screenshots for the steps.

Steps to Show Additional column containing the command line arguments

Using Ctrl+C to copy details of that process (**including the command line arguments**)

Hope it helps someone. Best

3

When using CygWin, if I start a Python process, this is an example of command line:

c:\CygWin\bin\python2.7.exe /usr/local/bin/sudoserver.py

But Process Explorer only sees the main exe:

Process Explorer not detecting full command line of Python process

(note the "path: [Error opening process message]" (see EDIT-1)). Same results for tasklist:

C:\>tasklist | find "python" /i
python2.7.exe                 5740 Console                    1    15.312 KB

So, the only trick I know until now, is finding it via CygWin Bash shell pgrep:

Luis@Kenobi /cygdrive/c/
$ pgrep -f -l server.py
5740 /usr/bin/python2.7 /usr/local/bin/sudoserver.py

It is useful to know this, as long as CygWin cohabits with no problems in Windows, and you can use it to run many POSIX and Python programs.

EDIT: In Windows you don't seem to need administrator priviledges for tasklist. In CygWin you will need them to be able to view an administrator's process (what seems more logical to me: the full command-line could have some parameters like passwords inside), so we must run the CygWin Bash in elevated Administrator Mode.

EDIT-1: This problem will not happen if you run Process Explorer as administrator. Thanks you for pointing, @Pacerier.

2
  • 3
    If you run as administrator you wouldn't be seeing [Error opening process message]
    – Pacerier
    Jan 20, 2015 at 3:20
  • You were right, @Pacerier . Too obvious to remember :-) . Thanks you. I have edited my post to reflect it. Jan 20, 2015 at 3:30
-3

go to run or goto start and search:

tasklist -m

tasklist -svc
1
  • 9
    That does not show the calling command line. /m shows loaded modules (DLLs, etc.) and /svc shows services hosted in each process.
    – Bob
    Nov 2, 2012 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .