TList Commands

The syntax of the TList command is as follows:

tlist [/p ProcessName | PID | Pattern | /t | /c | /e | /k | /m [Module] | /s | /v

Parameters

tlist

Without additional parameters, TList displays all running processes, their process identifiers (PIDs), and the title of the window in which they are running, if any.

/p ProcessName

Displays the process identifier (PID) of the specified process.

ProcessName is the name of the process (with or without file name extension), not a pattern.

If the value of ProcessName does not match any running process, TList displays -1. If it matches more than one process name, TList displays only the PID of the first matching process.

PID

Displays detailed information about the process specified by the PID. For information about the display, see the Comments section below. To find a process ID, type tlist without additional parameter.

Pattern

Displays detailed information about all processes whose names or window titles match the specified pattern. Pattern can be a complete name or a regular expression.

/t

Displays a task tree in which each process appears as a child of the process that created it.

/c

Displays the command line that started each process.

/e

Displays the session identifier for each process.

/k

Displays the COM components active in each process.

/m Module

Lists tasks in which the specified DLL or executable module is loaded. Module can be a complete module name or a module name pattern.

/s

Displays the services that are active in each process.

/v

Displays details of running processes including the process ID, session ID, window title, command line, and the services running in the process.

Comments

In its detailed display of a process (tlist PID or tlist Pattern), TList displays the following information.

• Process ID, executable name, friendly name of the program.
• Current working directory (CWD).
• The command line that started the process (CmdLine).
• Current virtual address space values.
• Number of threads.
• A list of threads running in the process. For each thread, TList displays the thread ID (TID), the function that the thread is running, the address of the entry point, the address of the last reported error (if any), and the thread state.
• A list of the modules loaded for the process. For each module, TList displays the version number, attributes, virtual address of the module, and the module name.

When using the /e parameter, valid session identifiers appear in the process list only under the following conditions. Otherwise, the session identifier is zero (0).

• On Windows 2000 and Windows Server 2003, at least one user must be connected to a session other than the console session.
• On Windows XP, Fast User Switching must be enabled and more than one user must be connected to the non-console session.
• On Windows Vista, where all processes are associated with two Terminal Services sessions by default, at least one user must be connected to the non-console session.