VMware ESXi and vSphere Cluster Management

Process Explorer Command-Line Switches

Reference guide to Process Explorer startup switches for elevation, tray startup, priority selection, and selecting a process by PID.

Process Explorer is a Windows process-inspection and troubleshooting utility. A command-line switch is an option appended to an executable launch command to change how the program starts.

These switches control Process Explorer itself. They do not change command-line arguments for a process that Process Explorer is inspecting.

General launch pattern

Place the executable name or quoted executable path first, followed by one or more switches:

procexp.exe /switch

For example:

procexp.exe /e /t /s:1234

Switches can be launched from Command Prompt, PowerShell, a script, or a shortcut. If the executable path contains spaces, quote the complete path and place the switches after the closing quotation mark.

"C:\Tools\Process Explorer\procexp.exe" /e /s:1234

Command-line switch reference

Elevation with /e

The /e switch requests elevation, meaning that Process Explorer runs with administrative privileges. On Windows versions that support UAC (User Account Control), Windows displays a consent prompt when Process Explorer starts.

procexp.exe /e

Depending on the account and security policy, you may approve the prompt or need to provide administrator credentials. If the prompt is declined, Process Explorer does not receive the requested elevated access.

Elevated access can help Process Explorer view details for protected or system-level processes and perform management actions that are restricted for a non-elevated program. Elevation does not automatically make every operation safe; use administrative access only when needed.

Starting minimized with /t

The /t switch starts Process Explorer minimized in the system notification area, the taskbar area commonly called the system tray.

procexp.exe /t

This is useful for unattended monitoring, background observation, or a startup shortcut where the main window should not appear immediately. To use the interface, locate the Process Explorer icon in the tray or its overflow area and restore the window.

Setting Process Explorer priority with /p

Process priority is a scheduling preference that influences how the operating system allocates CPU time to a process. The /p switch sets the priority of Process Explorer itself; it does not set the priority of a selected or monitored target process.

procexp.exe /p:r
procexp.exe /p:h
procexp.exe /p:n
procexp.exe /p:l
procexp.exe /p

Selecting a process by PID with /s:PID

A PID, or process ID, is the numeric identifier assigned to a running process. Use the /s:PID switch to select a process after Process Explorer opens.

procexp.exe /s:1234

This command selects the process whose PID is 1234, if that process is still running when Process Explorer starts. The PID must exist at launch time. If an application exits and restarts, Windows can assign it a different PID, so a previously recorded value may no longer identify the intended process.

Combining switches

Compatible startup switches can be placed in one launch command. For example, this command requests elevation, starts minimized to the tray, and selects PID 1234:

procexp.exe /e /t /s:1234

Other common launch patterns include:

• Request elevated access: procexp.exe /e
• Start in the tray: procexp.exe /t
• Use normal priority: procexp.exe /p:n
• Select a known process: procexp.exe /s:1234
• Elevate and select a process: procexp.exe /e /s:1234
• Elevate, use the tray, and select a process: procexp.exe /e /t /s:1234

Quoting executable paths

Command interpreters use spaces to separate the executable from its arguments. Enclose a path containing spaces in quotation marks, then put the switches after the closing quote:

"C:\Tools\Process Explorer\procexp.exe" /e /s:1234

The same placement applies when configuring a shortcut or invoking Process Explorer from a script: the quoted path identifies the executable, and each switch follows it as a separate launch option.

Troubleshooting

Process Explorer does not run elevated

• Confirm that the command includes /e.
• Approve the UAC prompt, or provide administrator credentials when required.
• If the prompt was declined, start the command again and approve it.
• Verify that the Process Explorer window is actually elevated before expecting access to protected process details.

The current account or local security policy may prevent elevation. In that case, use an account with administrator authorization or consult the system administrator.

The intended process is not selected

• Check that the PID is numeric and current.
• Confirm that the target process did not exit before Process Explorer finished starting.
• Remember that an application restart can give it a new PID.
• Relaunch with the updated PID. Use /e if visibility is restricted for the target process.

The launch command fails for a path with spaces

Quote the full executable path and put the switches after the closing quote:

"C:\Tools\Process Explorer\procexp.exe" /e /s:1234

The computer becomes less responsive

Process Explorer may have been started with realtime or unnecessarily high priority. Avoid /p:r for routine use. Relaunch with /p:n or /p:l when Process Explorer should have normal or minimal scheduling impact.

Process Explorer is not visible

If /t was used, the program is likely running in the system notification area rather than as an open window. Check the tray and its overflow area, then restore the Process Explorer window.

Exam-relevant notes

• /e requests UAC elevation at startup.
• /t starts Process Explorer minimized to the notification area.
• /p:<level> changes Process Explorer's own priority; r, h, n, and l mean realtime, high, normal, and low.
• /p without a level uses high priority.
• /s:PID selects a matching process after startup, but the PID must still exist at launch time.
• Quote executable paths containing spaces, and place switches after the closing quote.