View Processes On Windows Remote Computer (Remote Task Manager)
Use the Windows built-in tasklist.exe to view all processes on a remote Windows computer on a network. This is exactly how the Windows Task manager would show processes (without the username running the process). You can also kill an active remote process using taskkill.exe. Follow the steps below.
- Open Windows command prompt as administrator (Right-click -> run as administrator).
- Type the following command replacing the values to view all remote tasks on a remote target machine.
tasklist.exe /S SYSTEM /U USERNAME /P PASSWORD
Note: SYSTEM is remote computer, USERNAME is the name of authorized account to login to remote computer, and PASSWORD is the password for the account.
- You will see output of all process names, process id’s, and memory usage on the remote machine.
- We will kill the cmd.exe process next using taskkill.exe. Type the following command replacing the value.
taskkill.exe /S SYSTEM /U USERNAE/P PASSWORD /IM PROCESS
Note: SYSTEM is remote computer, USERNAME is the name of authorized account to login to remote computer, PASSWORD is the password for the account, and /IM PROCESS is the full name of the process.
- You will see a confirmation message displayed: SUCCESS: The process “cmd.exe” with PID “” has been terminated.
A list of all TaskList.exe options:
/S system Specifies the remote system to connect to. /U [domain\]user Specifies the user context under which the command should execute. /P [password] Specifies the password for the given user context. Prompts for input if omitted. /M [module] Lists all tasks currently using the given exe/dll name. If the module name is not specified all loaded modules are displayed. /SVC Displays services hosted in each process. /V Displays verbose task information. /FI filter Displays a set of tasks that match a given criteria specified by the filter. /FO format Specifies the output format. Valid values: "TABLE", "LIST", "CSV". /NH Specifies that the "Column Header" should not be displayed in the output. Valid only for "TABLE" and "CSV" formats. /? Displays this help message.
A list of all TaskKill.exe options:
/S system Specifies the remote system to connect to. /U [domain\]user Specifies the user context under which the command should execute. /P [password] Specifies the password for the given user context. Prompts for input if omitted. /FI filter Applies a filter to select a set of tasks. Allows "*" to be used. ex. imagename eq acme* /PID processid Specifies the PID of the process to be terminated. Use TaskList to get the PID. /IM imagename Specifies the image name of the process to be terminated. Wildcard '*' used. /T Terminates the specified process and any child processes which were started by /F Specifies to forcefully terminate the process(es). /? Displays this help message.
* Please use the comment form below. Comments are moderated.*
Comments 1
Thank you for this useful information.
Is there a way to use the tasklist command to output a list of all computers in a domain network running a specific process?
If this is not practical/possible, is there a good way to get such a list using Powershell and "get-process" command?