VMware ESXi and vSphere Cluster Management
Introduction to Process Explorer for Windows
Learn how to use Microsoft Sysinternals Process Explorer to inspect Windows processes, monitor resources, troubleshoot applications, capture dumps, and act safely.
Process Explorer is a free Windows process-management and system-monitoring utility from Microsoft Sysinternals. It shows considerably more detail than Task Manager, including process hierarchy, live resource activity, loaded components, handles, diagnostic controls, and process properties.
This guide explains the interface, metrics, process actions, troubleshooting workflows, and safety considerations for everyday Windows diagnosis.
What Process Explorer is
A process is a running instance of a program. Process Explorer lets you inspect and manage those instances in Windows. It belongs to the Sysinternals collection, a set of advanced Windows administration, monitoring, and troubleshooting tools.
Sysinternals began as tools produced by Winternals and is now maintained by Microsoft. Process Explorer is best understood as an advanced complement to Task Manager, although many users use it as an alternative when they need deeper information.
Why use it instead of only Task Manager?
- More detail: inspect process identity, hierarchy, memory values, loaded modules, handles, and other properties.
- Process relationships: see which process started another process and identify helper processes.
- Live monitoring: observe recent CPU, memory, I/O, disk, network, and sometimes GPU activity.
- Controls: suspend, resume, restart, change priority or affinity, create dumps, and terminate processes.
- Diagnostics: map a visible window to its process and investigate crashes, hangs, resource pressure, or unfamiliar executables.
This extra power also increases the consequences of mistakes. A process action that is useful during diagnosis can cause lost data, application failure, or system instability when applied to the wrong process.
Download and launch Process Explorer
- Obtain Process Explorer from the official Microsoft Sysinternals Process Explorer download source.
- Extract the compressed archive to a stable folder. Process Explorer generally runs without a conventional installation.
- Review the included license text and help file. The archive normally contains separate 32-bit and 64-bit executables.
- Run the executable appropriate for Windows. The 64-bit executable is generally the correct choice on modern 64-bit Windows systems.
- Accept the license on first launch.
Run the utility as administrator when you need full visibility or administrative process actions. Elevation can reveal more processes and enable more controls, but it also makes accidental changes more consequential. Use User Account Control carefully.
Launching means running the appropriate executable from the extracted download folder; no installer is normally required.
The main interface and live process list
The process list is the central workspace. It refreshes periodically, so displayed values are snapshots or recent-interval measurements, not necessarily long-term averages. A short CPU spike and sustained CPU consumption can therefore look different over time.
Common default columns include Process, CPU, Private Bytes, Working Set, PID, Description, Company Name, and DEP. You can customize visible columns and sort by a column by selecting its heading. The small graphs near the top provide high-level activity views, while the status bar summarizes system activity and process count.
| Column | Meaning | How to use it | Interpretation caution |
|---|---|---|---|
| Process | Executable or process name | Find a program and inspect its lineage | A familiar name does not prove that the file is genuine |
| CPU | Recent processor activity | Sort to find active consumers | Values change quickly and depend on the measurement interval |
| Private Bytes | Memory committed for exclusive use by a process | Look for sustained private-memory growth | High usage alone does not prove a leak |
| Working Set | Process memory pages currently resident in physical RAM | Estimate current RAM pressure from a process | Pages can be removed from or returned to RAM; it is not the same as total committed memory |
| PID | Windows process identifier | Correlate a process with logs or diagnostic tools | PIDs can be reused after a process exits |
| Description | Human-readable identity clue | Compare the process with the expected application | Metadata can be missing, inaccurate, or forged |
| Company Name | Publisher identity clue | Check whether the publisher matches expectations | Not definitive proof of trust |
| DEP | Data Execution Prevention status | Review a Windows memory-execution mitigation | DEP status is only one security signal |
Interpret metrics together. For example, high CPU with a matching application slowdown is more meaningful when sustained over time and supported by process identity, parent context, and system-wide history.
Process trees and lineage
A parent process is the process that creates another process. The resulting child process may perform work for the parent, host a helper service, or launch a separate component. Process Explorer renders these relationships as a hierarchical process tree.
Indented entries are children. Root or left-aligned entries may have a parent that is absent from the display or has already exited. Use the expand and collapse controls, or select a node and press Left Arrow or Right Arrow, to navigate branches.
Click the Process column header to cycle among alphabetical ascending order, descending order, and tree view. Tree view is useful for understanding related helpers and the potential effect of ending a process tree. If only one child must stop, select that child rather than terminating its parent tree.
Process context-menu actions
Right-click a process to access actions. Availability depends on permissions, process type, whether it owns a visible window, and whether it has child processes.
| Action | What it does | Typical use | Risk or limitation |
|---|---|---|---|
| Window controls | Bring to front, restore, minimize, maximize, or close an owned window | Control an unresponsive or hidden application window | Only applies to processes that own suitable desktop windows |
| Set Affinity | Restricts threads to selected logical processors | Specialized testing or isolation | Rarely a general performance fix; can reduce performance |
| Set Priority | Changes scheduling importance | Controlled diagnostic experiments | Increasing priority can starve other work and harm system responsiveness |
| Kill Process | Forcefully ends one process | Recover from a hung or excessive-resource application | Can lose data and prevent orderly cleanup |
| Kill Process Tree | Ends a process and related descendants | Stop an entire application group | May terminate more processes than intended |
| Restart | Ends and starts the selected application where supported | Quickly recover an application | Unsaved work may be lost; restart behavior varies |
| Suspend | Temporarily stops process execution | Pause a noncritical process for diagnosis | The application may stop responding and dependencies may be affected |
| Resume | Allows a suspended process to execute again | Restore normal operation after inspection | Does not undo changes made while the process was paused |
| Create Minidump | Captures a smaller process memory snapshot | Initial crash or hang investigation | Limited data; may still contain sensitive information |
| Create Full Dump | Captures substantially more process memory | Detailed developer or support analysis | Large file and greater privacy exposure |
| Check VirusTotal | Submits or checks file reputation through an online multi-engine service | Additional signal for an unfamiliar executable | Reputation results are not definitive and file-sharing privacy should be considered |
| Properties | Shows detailed process and executable information | Verify identity, location, performance, modules, or handles | Access and detail depend on permissions |
| Search Online | Searches for information about the process | Research an unfamiliar name | Search results can be misleading or incomplete |
Terminating processes safely
Closing a window normally asks the application to shut down and gives it an opportunity to save state and release resources. Kill Process is forceful termination: Windows stops the process without relying on normal application cleanup.
Forced termination may be appropriate for a persistently unresponsive program or one consuming excessive resources after less disruptive options fail. It can discard unsaved work, corrupt files being written, break dependent applications, and destabilize Windows. Killing a process tree has the broader effect of ending related child processes.
- Identify the process by name, PID, description, company, executable information, and tree position.
- Wait briefly if the application may be completing work.
- Try the normal close command or window close control.
- Capture a dump first when deeper investigation is needed.
- Terminate only after considering unsaved work and dependent processes.
Do not casually end essential Windows processes. If the system itself is unstable, restarting Windows may be safer than repeatedly terminating core components.
Suspending and resuming processes
Suspend temporarily halts a process until it is resumed. It can help pause a suspected noncritical process and observe whether CPU, disk, network, or other activity changes. Select the process again and choose Resume to allow execution.
A suspended application may stop responding to window operations because its threads are no longer running. Suspending critical Windows components can destabilize the system, and suspending an application can interfere with time-sensitive work or normal cleanup.
Creating process dumps
A process dump is a file containing a memory snapshot at a point in time. It can preserve evidence of a crash, hang, or unusual state before a process is terminated.
| Dump type | Data scope | Storage impact | Best use case | Privacy consideration |
|---|---|---|---|---|
| Minidump | Smaller, limited process state and diagnostic information | Usually much smaller | Initial troubleshooting or support requests | May still contain strings, paths, tokens, or application data |
| Full dump | Substantially more of the process memory | Can be very large | Detailed developer or advanced debugger analysis | Greater chance of containing credentials, documents, or other sensitive data |
To create one, right-click the selected process and choose the appropriate minidump or full-dump command. Store it where there is sufficient space, protect it as sensitive data, and share it only with an authorized support or development team.
Identify the process that owns a window
Process Explorer includes a toolbar crosshair or target tool. Hold the target control, drag it over the application window, and release it. Process Explorer selects the owning process in the process list.
This is useful for unidentified dialogs, pop-ups, windows with unclear titles, and applications whose executable names do not obviously match what is visible. After selection, inspect the process properties and its parent and child context.
System Information
Open the system-wide monitoring window with View > System Information or press Ctrl+I. The Summary view provides an overview. Depending on Windows, hardware, and drivers, more detailed CPU, Memory, I/O, and GPU views may be available.
Current-value indicators show what is happening now. History charts show recent behavior, and hovering over a chart can reveal values at a selected time. CPU and I/O history can help identify which process was the largest consumer at that point.
| Area | Metric | What it represents | Diagnostic question it helps answer |
|---|---|---|---|
| CPU | Total CPU use | Recent processor time used by the system or a process | Is a process or the whole system CPU-bound? |
| CPU | Kernel CPU time | CPU time spent in privileged Windows or driver code | Could drivers, system services, or I/O be contributing? |
| Memory | Commit charge | Committed virtual-memory demand, including private process memory and relevant system allocations | Is total committed memory approaching system limits? |
| Memory | Physical memory | RAM currently in use or available | Is the machine under physical-memory pressure? |
| Memory | Paged pool | Kernel memory that can be moved out of RAM when not actively needed | Is kernel memory usage unusually high? |
| I/O | I/O Bytes | Data transferred through input/output operations | Is activity broader than only disk or network traffic? |
| I/O | Network Bytes | Data transferred through network interfaces | Is network traffic associated with the slowdown? |
| I/O | Disk Bytes | Data transferred to or from storage | Is storage activity causing delays? |
| I/O | Read, write, and other operation counts | Number and type of I/O operations | Is a process performing many small operations rather than transferring large amounts? |
| GPU | GPU utilization | Recent graphics-processor activity where supported | Could graphics work or a driver be contributing? |
Kernel mode is the privileged execution mode used by Windows and drivers. Compare total CPU use with kernel-mode time: high kernel activity can point toward drivers, system services, or operating-system work rather than ordinary application code.
Committed memory is not identical to RAM currently resident. A process can have committed memory whose pages are temporarily not in physical RAM. Likewise, a high Working Set does not by itself prove a memory leak. Compare sustained trends, Private Bytes, commit charge, physical memory, and application behavior.
Replacing Task Manager
The optional Options > Replace Task Manager setting configures Process Explorer as the program launched by common Task Manager entry points, including Ctrl+Shift+Esc and taskbar access.
This affects the machine broadly and can affect other users. The Process Explorer executable must remain available and accessible. If it is moved, deleted, or blocked, users may be unable to launch the replacement or reach the usual Task Manager entry point.
Before enabling the option on a shared or managed computer, consider organizational policy, support procedures, permissions, and the executable's stable location. To restore normal behavior, open Process Explorer and disable Options > Replace Task Manager. If the utility cannot be launched, an administrator may need to undo the replacement through the appropriate Windows configuration or management process.
Safe workflow for basic diagnosis
- Find the suspicious, hung, or resource-intensive process by sorting the process list.
- Record its PID, name, description, company, CPU, memory values, and recent behavior.
- Inspect the parent and child processes. Use the crosshair tool if the visible window's owner is unclear.
- Open Properties and use online lookup or VirusTotal as supporting evidence, not as definitive proof.
- Open System Information to determine whether the problem is process-specific or system-wide.
- Choose the least disruptive action: wait, close normally, investigate, suspend temporarily, or restart.
- Capture a dump before termination when developers or support staff need evidence.
- Document what was observed and which action was taken.
Practical troubleshooting examples
An application consumes excessive CPU
- Sort by CPU and watch whether the value remains high.
- Check the process name, description, company, PID, and parent process.
- Use
View > System Informationto correlate the process with CPU history and distinguish a spike from sustained load. - Try a normal close before forced termination.
An unknown pop-up appears
- Drag the crosshair target over the pop-up.
- Review the selected process and its tree position.
- Inspect Properties, executable identity, and supporting online or VirusTotal information.
- Do not treat a company field, search result, or single reputation result as conclusive proof that the process is safe or malicious.
A frozen application needs investigation
- Use the process list or crosshair to identify the owning process.
- Check CPU, memory, disk, and I/O behavior.
- Create a minidump or full dump before ending the process if diagnostic evidence matters.
- Consider dump size, storage, and sensitive data exposure.
- Warn about unsaved work and child processes before termination.
A noncritical process is disruptive
- Suspend it temporarily.
- Observe whether resource use or visible behavior changes.
- Resume it after inspection.
- Avoid this experiment on essential Windows components.
The computer is slow but the cause is unclear
Compare process CPU, Private Bytes, Working Set, and I/O with the CPU, memory, disk, network, and GPU histories in System Information. A single high value may be normal; sustained pressure across related metrics is stronger evidence of a system-wide problem.
Only one child process should stop
Use the tree to identify the specific child, then terminate that child rather than using Kill Process Tree on its parent. Tree termination can stop multiple related processes.
Task Manager no longer opens
Check whether Process Explorer replacement is enabled, confirm that its executable remains accessible, and disable the replacement setting to restore normal Task Manager behavior.
Exam-relevant notes
- A PID identifies an active process but can be reused later.
- Private Bytes means committed memory exclusive to a process; Working Set means pages currently resident in physical RAM.
- A process tree represents parent and child relationships.
- Suspending is temporary; termination is forceful and can prevent cleanup.
- Kernel-mode CPU time represents privileged Windows or driver execution.
- Commit charge represents virtual-memory commitment and is not the same as RAM currently resident.
- Minidumps are smaller and less complete; full dumps are larger and contain more memory.
- Description and Company Name help identify a process but do not prove trust.
- Replacing Task Manager is a machine-wide configuration decision with shared-device and availability risks.
For a related overview, see A Short Introduction to Process Explorer.