VMware ESXi and vSphere Cluster Management

Process Explorer Keyboard Shortcuts

A practical reference for Process Explorer keyboard shortcuts covering process views, handles, DLLs, saving data, refreshing, column sets, and process management.

Process Explorer is a Windows process-inspection and management utility. Its keyboard shortcuts accelerate common tasks in the main process list and the lower pane, including navigation, resource investigation, saving information, refreshing data, and managing processes.

Some shortcuts operate on the currently selected row or selected process. Before using an action shortcut, confirm that the correct process is highlighted. Viewing and navigation shortcuts are generally low risk, while shortcuts that save data, launch processes, or terminate processes deserve additional care.

Quick reference

Saving and copying displayed information

Ctrl+A and Ctrl+S save the currently displayed Process Explorer data to a file. These shortcuts are appropriate when you need a record of the visible process list or lower-pane information.

Ctrl+C copies the currently selected row. It works with a selected row in the main process list or in the lower pane. This is different from exporting the current display: copying captures one row, while a save shortcut preserves the displayed data more broadly.

Lower-pane display and object views

The lower pane is the secondary Process Explorer pane that shows details associated with the selected process. Press Ctrl+L to show or hide it.

A handle is a reference a process uses to access an operating-system object, such as a file or registry key. Press Ctrl+H to switch the lower pane to Handle view, which examines handles held by the selected process.

A DLL, or dynamic-link library, is a library loaded by an application or system process. Press Ctrl+D to switch the lower pane to DLL view, which examines loaded DLLs and related modules.

These lower-pane commands help investigate resources associated with a selected process. Select the process first, show the lower pane if necessary, and then choose the view that matches the question you are investigating.

Finding handles and DLLs

Press Ctrl+F to open the search feature for handles or loaded DLLs. This is useful when you need to identify which process has a particular file, registry key, named object, or module open.

1. Press Ctrl+F.
2. Search for the relevant file, object, or library name.
3. Use the matching result to select or investigate the associated process.

System and online process information

Press Ctrl+I to open the System Information dialog. Use it when you need broader system information rather than details about only one process.

Press Ctrl+M to initiate an online lookup for the selected process. A process must be selected, and network access is required. If the lookup is unavailable or unhelpful, use local process, handle, DLL, and system-information views instead.

Process display controls

Press Ctrl+T to toggle the process list into a hierarchical tree display. A process tree is a parent-child hierarchy showing processes started by other processes. Tree view helps reveal which process launched another process and is especially useful during startup or descendant-process investigations.

Press Space to pause or resume automatic updating, the periodic refresh of displayed process information. Pausing is helpful when rows are changing too quickly to inspect. Press F5 when you want to manually refresh the displayed data.

Column-set shortcuts

A column set is a saved arrangement of process-list columns. Press Ctrl+1, Ctrl+2, or another numbered Ctrl+number shortcut to load the corresponding configured column set.

The available layouts depend on the column sets configured and saved in Process Explorer. For example, one layout may emphasize performance information while another may show process-identification or investigation fields. If a shortcut does not restore the expected layout, verify that the relevant column set exists and has been saved.

Creating and terminating processes

Press Ctrl+R to start a new process from Process Explorer. Use this action when you need to launch a program while working within the utility.

Press Delete to terminate the selected process. Press Shift+Delete to terminate the selected process tree, including descendant processes started by it.

Safer termination workflow

1. Select the target process.
2. Confirm its identity and parent-child relationship.
3. Consider whether it owns unsaved work, services, or important child processes.
4. Use Delete to end only the selected process.
5. Use Shift+Delete only when ending the complete process tree is intended.

Practical investigation workflows

Identify a process holding a resource

1. Open the search feature with Ctrl+F.
2. Search for the relevant file, object, or library name.
3. Select the matching process for further inspection.

Inspect modules loaded by an application

1. Select the application in the main process list.
2. Show the lower pane with Ctrl+L if it is hidden.
3. Switch to DLL view with Ctrl+D.
4. Review the modules associated with the selected process.

Preserve a stable snapshot

1. Press Space to pause automatic updates.
2. Inspect the process list and lower-pane data without rows changing.
3. Copy a selected row with Ctrl+C, or save the displayed data with Ctrl+A or Ctrl+S.
4. Press Space again to resume updates.

Switch between investigation layouts

1. Use Ctrl+1, Ctrl+2, or another numbered Ctrl shortcut.
2. Load the column set appropriate to the task, such as performance monitoring or process investigation.

High-impact shortcuts and safe-use guidance

Troubleshooting shortcuts

Handle or DLL information is not visible

• Confirm that a process is selected.
• Show the lower pane with Ctrl+L.
• Use Ctrl+H for handles or Ctrl+D for DLLs.

The process list changes before it can be examined

• Press Space to pause automatic updating.
• Use F5 when a deliberate refresh is needed.

A process cannot be terminated

• Verify that the intended process is selected.
• Check whether it requires elevated rights or is protected.
• Consider the consequences before attempting to terminate its process tree.

Online process lookup is unavailable

• Ensure that a process is selected before using Ctrl+M.
• Check network connectivity.
• Use local process, handle, DLL, and system-information views as alternative investigation sources.

The desired process-list layout is not restored

• Try the relevant Ctrl+number shortcut.
• Confirm that the expected column set has been configured and saved.

Help access

Press F1 to open Process Explorer Help. Use it when you need command-specific guidance or clarification while working in the interface.

For related reference material, see keyboard shortcuts.