If you've been using Windows for a while, there's a good chance you've needed to use the built-in Task Manager at one point or another. Whether you're killing a frozen process, tracking down some nasty malware, or figuring out what's eating up all that memory, Task Manager is an invaluable tool for any intermediate or power user. But for enthusiasts who want extra control, more information, and a host of extra features, there's a more powerful alternative available: Microsoft's free Process Explorer tool.
Process Explorer is not just an improved version of Task Manager with more information and control over your system processes. It also includes the ability to detect viruses and identify when programs are attached to the software you want to remove.
Part ofWindows Sysinternals Toolkit(formerly "Winternals"), Process Explorer can be downloaded from TechNetthis bookor as part of the entire suite. If you plan to completely replace Task Manager with Process Explorer, and you probably will, you should get the full suite. More on that later. These are just some of the things you can do with Process Explorer.
The basics
When you first open Process Explorer, there is a lot of information and it can be overwhelming. Do not panic! This is what it's all about.
mike clearIn the upper half of the main window you will see a list of processes. This shouldn't be completely unfamiliar if you've used the Details tab in Task Manager (also known as the Processes tab in Windows XP and earlier). It lists the process name, process description, CPU and memory usage, and the company name of the software creator, which is very useful when you are looking for malware. (Pro tip: Microsoft is not a legitimate software maker.) You can customize your columns to include more or less information by right-clicking on the column header, just like any other program with sortable columns.
Processes are presented hierarchically, which means that if a process spawns another process, the child process will be listed nested below the parent. If you prefer an alphabetical listing, just click the "process name" column header. That list is constantly being updated, but if you want to freeze it in time—for example, to examine a process that appears and disappears faster than you can click on it—you can press space to pause the updates.
There's a lot more information here: the scrolling line graphs at the top of the window, the color codes, the bottom panel showing the DLLs and drivers, but for now let's focus on the list of processes.
[Further Reading: Best Windows 10 Tips, Tricks, and Tweaks]
Kill a process tree
Many people have used Task Manager to kill a process that misbehaves at some point or another. This functionality also exists in Process Explorer, where it is calledslaughter processwhen you right click on a process. Process Explorer is better than the standard Windows Task Manager, giving you the option to kill the entire process tree. Right click on a process and clickKill process tree;select itProcess > Delete process tree;or simply highlight your process and clickShift-Delete.
brad chacosWhy would you want to kill an entire process tree? Sometimes when a process stalls, it's not the real culprit. Instead, one of the spawned child processes is the actual bad seed (we're looking at you, Chrome). Even when the parent process is the true villain of the story, killing it can sometimes leave behind orphaned processes that can't do anything without their parent, but still consume resources. Killing the process tree solves both problems at once.
Find out which process has a locked file
One of the most frustrating things Windows users regularly encounter is trying to edit or delete a file only to get some variation of the old "This file is open in another program" or "This file is locked for editing" message. If you're a multitasker and have a dozen windows open, figuring out which one is blocking your target can be a time-consuming exercise. Process Explorer offers a solution.
mike clearOpen Process Explorer, select a process and clickCtrl+H. This changes the bottom panel to "Handle View". This will display all the files, folders, threads, and threads that the process has opened. If you suspect that you know which process is locking your file and want to confirm it, this is where you do it.
But what if you don't know which process is holding your file hostage? Should it go through all the processes in the list looking for your file? It could, but there's a much easier way: clickFind > Find Identifier or DLL, or use theControl+Fkeyboard shortcut. Just type the file name and it will tell you what process is locking that file.
Is this a virus?
Process Explorer is especially useful if you are looking for malware. For some really in-depth examples, you can always check out the world-class work of Mark Russinovich.Series "The case of..."of blog posts and videos. But you don't have to be a malware detection expert like Russinovich to figure out if a suspicious process is a virus. Process Explorer uses VirusTotal, a Google project that searches for questionable processes in the databases of major antivirus companies.
First, click on the suspicious process and go toOptions > VirusTotal.com > Check VirusTotal.com. (The same path is also available in the context menu.) If this is your first time checking a process, it will take you to the VirusTotal Terms of Service. Otherwise, it adds a VirusTotal column to Process Explorer.
mike clearThis column shows the number of antivirus services that have flagged this specific process as a possible virus. For example, "7/59" means that 7 out of 59 antivirus vendors think the process is potentially dangerous. The higher the number, the more likely it is that the process is actually malware. For more information, simply click on the numbers to open the VirusTotal website, where you can learn more.
Of course, like any other antivirus measure, this is not foolproof and you may get false positives. For example, Process Explorer itself is occasionally flagged as dangerous. Additionally, viruses may be too new to have been widely reported, or they may be implementing various anti-malware techniques. However, Process Explorer's VirusTotal integration is a good start.
Complete replacement of Task Manager
Once you get familiar with it, you'll find that Process Explorer is better at managing tasks than Task Manager in almost every way, and you'll never want to open Task Manager again. Process Explorer can help you with that.
In the Options menu, you will see an item labeledReplace Task Manager. Select that and all actions that would normally launch Task Manager, regardless of whether you invoke it from the command prompt or select it from theCtrl+Alt+Suprmenu, start Process Explorer. In Windows XP and earlier, that's all you need to do, but in Windows 8 and 10, there's a twist.
The Windows 8 and 10 versions of the Task Manager don't just manage processes. They also handle the startup and service management items, which were found in MSConfig in earlier versions of Windows. If you replace this version of Task Manager with Process Explorer, will you lose functionality? When it comes to services, no. The default services application built into Windows (just typeservicesin your start menu and you will find it) handles the management of its services very well.
mike clear But when it comes to startup items, yes, you will lose functionality. Process Explorer doesn't handle this, so you'll need another tool for that.
That is why we recommend that you download thethe entire sysinternals suiteif you want to replace Task Manager entirely. There is a utility calledautoejecutableswhich absolutely removes the functionality of the Task Manager startup item. How to use Autoruns is a topic for another article, but you'll want to extract it and keep it handy for when you want to modify your startup.
Most people will use Process Explorer for the features we've outlined here, but dig deeper and you'll find even more powerful user tools in its nooks and crannies. If youIn factIf you want specific information, you can find more details in Process Explorer's incredibly detailed help files.
FAQs
Is Process Explorer better than Task Manager? ›
Process explorer is the best-upgraded version of the windows traditional task manager. Process Explorer is a freeware task manager and system monitor for Microsoft Windows created by SysInternals, which was acquired by Microsoft and then again introduced as Windows Sysinternals.
What is the use of Process Explorer? ›Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The Process Explorer display consists of two sub-windows.
How do I replace Process Explorer in Task Manager? ›The only way to revert it is to go into the registry and remove the entry "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" and remove the debugger entry.
What is the alternative for Task Manager in Windows 11? ›The best alternative is Process Explorer, which is free. Other great apps like Windows Task Manager are Process Hacker, htop, Stacer and Glances. Windows Task Manager alternatives are mainly Process Monitoring Tools but may also be Process Management Tools or System Information Utilities.
Is Process Hacker the same as Task Manager? ›The default Task Manager provides basic information, but Process Hacker goes well beyond it, while still keeping the interface clean and usable. Color coding helps identify, at a glance, what category a running process belongs to.
Is it okay to End Process Explorer EXE? ›It is "safe" to end it. Task manager has a special option "Restart" that may be preferable. Explorer.exe handles your explorer windows as well as your taskbar/start menu systems as well as general file browser.
How do I get my Task Manager back to normal? ›To switch Task Manager to its normal display mode, double-click the top border of the window.
Is there another way to open Task Manager? ›CTRL + Shift + ESC
Using your keyboard, press and hold the CTRL, Shift, and ESC keys simultaneously. Then let go of all three keys. Task Manager launches.
To restore the default Task Manager of Windows 11, just uninstall the app from Settings > Apps > Installed apps. Find there "Classic Task Manager + msconfig" and uninstall it. This will bring back the default app.
What should I disable in Windows 11 for better performance? ›- Restart, Update.
- Disable Startup Programs/Apps.
- Debloat Windows 11.
- Change Power Mode.
- Defragment Hard Disk.
- Add More Memory on Windows 11 (RAM/SSD Upgrade)
- Disable Restartable Apps.
- Uninstall Unwanted Software/Bloatware.
What is system idle process high CPU usage? ›
The System Idle Process is, as the name suggests, just a measure of how much free processor time your computer currently has. So, if System Idle Process is taking up 99 percent of your CPU's time, this means that your CPU is only using one percent of its processing capability to run actual tasks.
What is the advantage of Process Explorer? ›With Process Explorer, you get detailed access to the threads. You can see all threads in a process and dial in on a specific thread to interact with it by viewing the stack or even suspending or killing the thread!
How do I run Process Explorer? ›You need to run it from wherever you saved the executable. The .exe filename is procexp.exe, look for that and double-click it. There is also a option in process explorer to replace task manager, then it launches when you hit c-a-d and select task manager.
Can Process Explorer connect to remote computer? ›Remote Process Explorer is a Windows utility used to manage processes on a remote computer. This product utilizes built-in Windows (e.g. Remote Desktop, Computer and Service Management, network applications, etc.)
Is Process Hacker spyware? ›Process Hacker is 100% safe to use. Some AV vendors may class it as a 'Hack Tool' and for this reason, some organizations may see alerts in their security tools for Process Hacker. This does not mean that it contains a virus.
Where is spyware in Task Manager? ›If you're curious about whether a specific program is malicious, right-click it in the Task Manager and select “Search Online” to find more information. If information about malware appears when you search the process, that's a sign you likely have malware.
What are the features of Process Hacker? ›Key features of Process Hacker:
Powerful process termination that bypasses security software and rootkits. View, edit and control services, including those not shown by the Services console. View and close network connections. Starts up almost instantly, unlike other programs.
But what happens if you end Windows Explorer in the Task Manager? As it turns out, terminating Windows Explorer will not only close any open File Explorer windows, but it will also render the Start menu, Taskbar, and System Tray unusable.
Is it safe to end Windows processes? ›Having processes running is an unavoidable part of using Windows. Some are essential for the smooth running of the OS and should be left alone. Others represent apps or services that don't need to be running and can be ended safely. Ending even a few resource-hungry processes can really help improve PC performance.
Is it OK to end processes in Task Manager? ›While stopping a process using the Task Manager will most likely stabilize your computer, ending a process can completely close an application or crash your computer, and you could lose any unsaved data. It's always recommended to save your data before killing a process, if possible.
How do I show hidden processes in Task Manager? ›
Right-click the Windows icon or press the Win and X keys at the same time. In the displayed window, click Task Manager. If the Task manager is opened for the first time and the Processes tab is hidden, click More details. The Processes tab and other tabs will be displayed.
How do I fix corrupted Task Manager? ›If Task Manager doesn't work properly in Windows 10/8 after running SFC, try DISM to fix it. Step 1: You need to run Command Prompt as administrator. Step 2: Then, type the command line DISM /Online /Cleanup-Image /ScanHealth in the pop-out CMD window and end with Enter key to scan for component store corruption.
How do I clean up my Task Manager? ›- Press "Ctrl-Shift-Esc" to open the Task Manager.
- Click the "Processes" tab.
- Right-click any active process and select "End Process."
- Click "End Process" again in the confirmation window. Some processes, such as vital Windows processes, cannot be ended this way.
- Press Win + R on your keyboard to open the Run dialog box.
- Type in “taskmgr” into the text box and hit Ctrl + Shift + Enter.
- This will launch Task Manager with administrative privileges.
You don't necessarily need a keyboard in order to open the Task Manager. Starting the program from the context menu allows you to manage it without a single keystroke. To do this, first right-clickon the taskbar in order to call up the context menu. In this, select the “Task Manager” option with the left mouse button.
How do I open Task Manager instead of Ctrl Alt Del? ›To open the Run window, press Windows+R, then type "taskmgr", and then click "OK" or hit Enter. Task Manager will open up. Simply press Ctrl+Shift+Escape on your keyboard to bring up Task Manager.
Can you recover deleted tasks on Microsoft to do? ›Sign in to Outlook on desktop with the same Microsoft account that you use with Microsoft To Do. Navigate to your email folder list, then select Deleted Items. Locate the deleted task, right-click it, and then select Move > Other Folder > Tasks. The deleted task will then eaappear in its correct list.
How do I remove a deleted app from Task Manager? ›- Press down the CTRL + SHIFT + ESC keys together to open the Task Manager.
- It should already be on the processes tab.
- Select the Program or App that you want to uninstall from the list under processes.
- Right click on the Program/App and select End Task.
Open Task Scheduler on Windows 11. Right-click the Task Scheduler Library folder. Select the “Enable All Tasks History” option to enable the feature. (Optional) Select the “Disable All Tasks History” option to disable the feature.
What is Connected Devices Platform Service? ›The Connected Devices Platform Service Protocol provides a way for devices such as PC's and smartphones to discover and send messages between each other. It provides a transport-agnostic means of building connections among all of a user's devices and allows them to communicate over a secure protocol.
Does disabling Windows Defender improve performance? ›
Once you disable file hash computation, Microsoft Defender will no longer computer file hashes for every executable on your system, giving a potential performance boost.
What should I turn off in Windows? ›- Disable Windows Defender. ...
- Windows Mobile Hotspot Service. ...
- Print Spooler. ...
- Fax Service. ...
- Downloaded Maps Manager. ...
- Windows 10 Security Center. ...
- Certificate Propagation Service. ...
- Universal Telemetry Client (UTC)
The primary purpose of the idle process and its threads is to eliminate what would otherwise be a special case in the scheduler. Without the idle threads, there could be cases when no threads were runnable (or "Ready" in terms of Windows scheduling states).
What does service host do? ›The Service Host (svchost.exe) is a shared-service process that serves as a shell for loading services from DLL files. Services are organized into related host groups, and each group runs inside a different instance of the Service Host process. In this way, a problem in one instance doesn't affect other instances.
Why is my computer idling so high? ›If you see an idle percent that looks too high, check to see if any open programs are not responding. Sometimes a program can get stuck in a memory loop or stop responding, causing the processor to become idle due to not having any commands to process from an open program.
How do I stop all unnecessary tasks in Windows 10? ›- Press the Ctrl + X then choose the Task Manager option.
- Click on the Startup tab.
- Select any of the system trays, and further change the status to Disable. It will remove the process from the Window Startup.
- Identify your challenges and constraints.
- Create a list of top options.
- Test each app yourself.
- Test each app with your team.
- Get feedback from your team.
- Calculate and justify the cost.
The best online project management tool for developers is monday.com for its outstanding capabilities that streamline work for maximum productivity. The workflow customization feature facilitates effective collaboration and allows teams to easily build the ideal workflow.
Can you list out the difference between Task Manager and Process Explorer? ›It all adds up to be pretty simple: Process Explorer shows the usage of the cpu without any scale, Task Manager and Resource Monitor show it with a scale of the current CPU speed (except for the Details tab for some reason). It also seems like Task Manager cannot show values over 100%, but Resource Monitor can.
What will happen if you end Process Explorer exe? ›But what happens if you end Windows Explorer in the Task Manager? As it turns out, terminating Windows Explorer will not only close any open File Explorer windows, but it will also render the Start menu, Taskbar, and System Tray unusable.
Which Windows 10 processes are unnecessary? ›
- Disable Windows Defender. ...
- Windows Mobile Hotspot Service. ...
- Print Spooler. ...
- Fax Service. ...
- Downloaded Maps Manager. ...
- Windows 10 Security Center. ...
- Certificate Propagation Service. ...
- Universal Telemetry Client (UTC)
All types of organizations can benefit from process-based management. The main advantages are: It provides a clear and global vision of the organization and of its internal relationships. An organization that is managed with processes is able to be more flexible than one based on hierarchies.
Why do I need processes? ›Why are processes important? They are important because they describe how things are done and then provides the focus for making them better and how they are done determines how successful the outcomes will be. If you focus on the right processes, in the right way, you can design your way to success.
What is process mapping good for? ›Process maps help to gain insight into how processes work—and also how well they work. When a process has been mapped out, it's easier to see where issues can occur, where time and effort is being needlessly wasted, and where changes might be made to improve the process.
Are there hidden processes in Task Manager? ›The best way to find these hidden programs is to use the Windows Task Manager and Computer Management. Both tools show the list of hidden processes that are running on the computer, but they do it in different ways. Press the “Ctrl”, “Alt” and “Delete” keys simultaneously on the keyboard.
What processes should I not end on Task Manager? ›Windows Startup Application
You should not kill Windows Startup application (wininit.exe) in Task Manager. After you start Windows, it will start some crucial processes for most background running applications and processes. It needs stay running until you shut down your computer.
If you see 2 explorer processes running when you open the task manager, you might think there is something wrong with your Windows installation. However, this is a normal behavior for Windows and you might have inadvertently checked a box that causes folder views to run on the second process.
What happens if you end process in Task Manager? ›When you End Task a process or program running on the computer, it forces that program to abnormally stop. If that process is in the middle of performing a task, aborting it may cause errors, lose any work not been saved, and may cause data corruption.
How do I close unnecessary processes in Windows 10? ›- Press the Ctrl + X then choose the Task Manager option.
- Click on the Startup tab.
- Select any of the system trays, and further change the status to Disable. It will remove the process from the Window Startup.
Switch off any apps you don't need and leave only the most useful ones – Calendar, Maps, People, Photos, Settings and Store, for example – switched on in the background. Was this article helpful?
What background processes can I turn off? ›
The best kind of processes to disable using this method is system tray apps and services, such as Discord, Slack, and antivirus programs. These programs always run in the background and never close, even if you quit their main application window.