18

I know in Linux it's very useful the pstree command and something like that is what I'm looking for... but how to make a detailed process list (tree) on Windows terminal?

2
  • have you tried with top or ps auxf maybe it's not what you're looking for, but combined with pstree you should get the information, if it's worth it to you, please let me know to make this an answer!!
    – poz2k4444
    Jan 24, 2013 at 18:31
  • 1
    oh, sorry I just read you're on windows...there is an app called process monitor that should do the trick...
    – poz2k4444
    Jan 24, 2013 at 18:33

4 Answers 4

14

You could use a program called Process Monitor. This program allows you to do what you want.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

It also provides exactly what you want:

Process tree tool shows relationship of all processes referenced in a trace.

8

Use pslist64.exe -t from SysInternals.

2
  • This is useful for generating a list of processes on the command line that can be saved to a file or processed as text. Feb 1, 2021 at 23:58
  • As the OP asked for a command line tool, I guess this is the most appropriate answer. And also exactly what I was looking for when connecting to a remote Windows server via SSH to quickly see what processes are currently running.
    – CodeFox
    Dec 16, 2021 at 11:56
3

Try Process Exporer from Sysinternals. It is like an advanced task manager, there is a tree view as well.

1
  • 1
    I was going to post this as an answer but you were here already so upvoted. I find the interface of Process Explorer to be more usable than Process Monitor for navigating the tree of processes. Feb 2, 2021 at 0:01
0

This powershell cmdlet Print-ProcessTree will list a primitive process tree.

function Print-ProcessTree() {

    function Get-ProcessAndChildProcesses($Level, $Process) {
        "{0}[{1,-5}] [{2}]" -f ("  " * $Level), $Process.ProcessId, $Process.Name
        $Children = $AllProcesses | where-object {$_.ParentProcessId -eq $Process.ProcessId -and $_.CreationDate -ge $Process.CreationDate}
        if ($null -ne $Children) {
            foreach ($Child in $Children) {
                Get-ProcessAndChildProcesses ($Level + 1) $Child
            }
        }
    }

    $AllProcesses = Get-CimInstance -ClassName "win32_process"
    $RootProcesses = @()
    # Process "System Idle Process" is processed differently, as ProcessId and ParentProcessId are 0
    # $AllProcesses is sliced from index 1 to the end of the array
    foreach ($Process in $AllProcesses[1..($AllProcesses.length-1)]) {
        $Parent = $AllProcesses | where-object {$_.ProcessId -eq $Process.ParentProcessId -and $_.CreationDate -lt $Process.CreationDate}
        if ($null -eq $Parent) {
            $RootProcesses += $Process
        }
    }
    # Process the "System Idle process" separately
    "[{0,-5}] [{1}]" -f $AllProcesses[0].ProcessId, $AllProcesses[0].Name
    foreach ($Process in $RootProcesses) {
        Get-ProcessAndChildProcesses 0 $Process
    }
}

Modified from actualadmins.nl.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .