VMware ESXi and vSphere Cluster Management

Process Actions in Process Explorer

Learn how to use Process Explorer actions safely, including window control, affinity, priority, termination, suspension, dumps, reputation checks, and properties.

Process Explorer is a Windows process-inspection and management utility. A process is a running instance of an executable program. Each process has a numeric process ID (PID) and may own one or more application windows, threads, handles, and loaded modules.

To access process actions, select a process and right-click it. The resulting process context menu contains actions for the selected process. The available choices depend on the process, your permissions, and whether that process owns a visible desktop window.

Some actions affect only a process's window, while others affect the underlying process itself. This distinction is important: closing a window normally is different from forcibly terminating the process that owns it.

Process Explorer actions at a glance

Action	What it does	Typical use	Primary risk or limitation
Window	Controls a visible window owned by the process.	Bring forward, restore, minimize, maximize, or close an application window.	Unavailable for background processes and does not forcibly terminate the process.
Set Affinity	Restricts the process to selected logical processors.	Compatibility testing or isolating a workload temporarily.	Can reduce performance and is usually not a permanent optimization.
Set Priority	Changes the process's base scheduling priority.	Testing responsiveness or scheduling behavior.	Higher priorities can starve other applications and system work.
Kill Process	Forcefully terminates one process.	Stopping an unresponsive application after normal closing fails.	Unsaved data may be lost and dependent components may be destabilized.
Kill Process Tree	Terminates the selected process and its descendants.	Stopping applications, installers, scripts, and helper processes together.	Parent-child relationships do not always represent every operational dependency.
Restart	Ends the process and attempts to start it again.	Recovering a stalled user process.	May interrupt work or be unavailable when the original launch information is insufficient.
Suspend	Temporarily prevents the process from executing.	Pausing a runaway workload during investigation.	Can freeze the application or block dependent activity.
Resume	Allows a suspended process to execute again.	Returning a paused process to normal operation.	Does not undo other changes made during the suspension.
Create Dump	Captures process state in a diagnostic dump file.	Investigating hangs, crashes, or high-resource incidents.	Full dumps can be large and may contain sensitive memory contents.
Check VirusTotal	Obtains an external reputation or detection summary for the process image.	Adding a malware-investigation signal.	A detection ratio is not conclusive proof, and external submission has privacy implications.
Properties	Displays detailed information about the selected process.	Identifying the process before taking action.	Some information or operations may require additional permissions.
Search Online	Searches the web for the process name.	Finding background information about an unfamiliar name.	Names can be generic or impersonated; search results are not authoritative evidence.

Window management actions

For a process that owns a visible window, the context menu can include a Window submenu. A visible window is an application window associated with a process that can be managed on the desktop.

Bring to Front or the equivalent foreground action places the window above other windows.
Restore returns a minimized or maximized window to its previous normal size.
Minimize reduces the window to the taskbar.
Maximize expands the window to occupy the available desktop area.
Close sends a normal close request to the application window.

Window commands are unavailable when a process has no visible window. This is common for services, console processes, background workers, and helper processes. The visible application may also be owned by a different process, so inspect the process tree and properties if the expected window actions are missing.

Closing a window is not the same as using Kill Process. A normal close gives the application an opportunity to save work and shut down cleanly. Forced termination stops the underlying process and can discard unsaved data.

Processor affinity

Processor affinity is the set of logical processors on which a process is permitted to run. A logical processor is an operating-system-visible CPU execution unit, including a physical core or a hardware thread. Affinity matters most on systems with multiple cores or logical processors.

Choose Set Affinity from the process context menu, then select one, several, or all available logical processors. The selected setting limits where the process's threads may run. For example, temporarily allowing an application to run on only a subset of processors can help test whether a compatibility problem is related to multicore behavior.

Affinity can also isolate a workload during diagnosis. However, limiting the available processors can reduce throughput and responsiveness. Treat it as a temporary test or control, not as a general permanent performance optimization. Restore normal affinity after testing unless there is a documented operational reason to keep the change.

Process priority

A process's base priority influences how Windows schedules its threads and allocates CPU time relative to other runnable work. Use Set Priority to select a different scheduling priority for the process.

Raising priority may improve responsiveness for one workload, but it can reduce responsiveness for other applications and system tasks. Avoid inappropriate high priorities on ordinary systems, and use particular caution with real-time priority. A CPU-intensive process at an excessive priority can starve important work and make the system appear hung.

If responsiveness worsens after a priority change, return the process to a normal priority and investigate the cause of its CPU consumption rather than relying on priority changes as a solution.

Terminating a single process

Kill Process is a forceful termination action. Process Explorer requests confirmation before carrying it out. Use it only after identifying the executable and considering the consequences.

A suitable use case is an unresponsive user application that will not close normally. Forced termination can discard unsaved data, interrupt file operations, and destabilize an application or component that depends on the process. Do not use it casually against unknown Windows components, security software, services, or business-critical processes.

Terminating a process tree

A parent process is the process that launched another process. The launched process is a child process. Together, these relationships form a process tree, a hierarchical view of related processes.

Kill Process Tree terminates the selected process together with its descendants. This is useful when an application, installer, script, or development tool launches helper processes that would otherwise remain active. Ending only the parent can leave those helpers running.

Use this action carefully. Parent-child relationships do not always fully represent operational dependencies. A child may have become independently important, and related processes may not be direct descendants. Review the tree, paths, command lines, and ownership before confirming.

Restarting a process

Restart ends the selected process and attempts to start it again. Restarting can recover a stalled user process without requiring the user to launch it manually.

Availability and behavior depend on how the process was launched and whether Process Explorer has enough information to relaunch it. Restarting can interrupt active work, close unsaved documents, or produce a different result if the original launch environment has changed. It is generally inappropriate for critical services or system processes unless an approved procedure specifically calls for it.

Suspending and resuming

Suspend temporarily prevents a process from running without terminating it. Resume allows a suspended process to execute again.

Suspension can help diagnose a runaway workload, temporarily free CPU activity, pause a suspicious process while evidence is collected, or reveal whether a process is responsible for a visible system effect. It can also freeze the application's interface, block dependent processes, hold files or other resources, and make the system appear unresponsive.

Use suspension briefly and document what was changed. Resume the process when appropriate, or follow an approved procedure for dump collection, escalation, or termination.

Creating process dumps

Create Dump captures process state for later troubleshooting or debugging. A dump can preserve useful evidence during a hang, crash investigation, or high-resource incident before the process is restarted or terminated.

Dump type	Information captured	File size expectation	Best use case	Sensitivity considerations
Minidump	Limited process information, such as selected metadata and diagnostic state.	Relatively small and easier to collect or transfer.	Initial investigation, lightweight support collection, or cases where limited state is sufficient.	May still contain application data and should be protected.
Full memory dump	Substantially more of the process's memory state.	Large; size depends substantially on the process memory footprint.	Deep analysis of difficult hangs, crashes, or memory-related behavior.	Can contain credentials, documents, tokens, messages, and other sensitive memory contents.

Choose a minidump when it provides enough evidence and a full dump when deeper memory analysis is justified. Store dump files securely, restrict access, and use approved procedures before sharing them externally.

Checking VirusTotal reputation

Check VirusTotal obtains a reputation or multi-engine malware-detection summary for the process image through VirusTotal, an external service. A detection ratio is an investigation signal, not conclusive proof that a file is malicious. False positives, heuristic detections, and incomplete engine coverage are possible.

Consider privacy and network implications before checking or submitting file information to an external service. A file may contain proprietary code, and service handling policies may not match your organization's requirements.

For an unexpected result, review the executable path, publisher, digital signature, hash, command line, and parent process. A digital signature provides publisher and integrity information that helps assess an executable but is not by itself a guarantee of safety.

Viewing process properties

Properties is the central place for detailed information about a selected process. Inspect it before taking disruptive action whenever possible.

Image path: the location of the executable on disk.
Command line: the executable and arguments used to start the process.
Security context: the account, integrity level, and related permission information.
Handles: files, registry keys, synchronization objects, and other resources opened by the process.
Threads: execution units within the process and their activity.
Performance activity: CPU, memory, I/O, and related resource behavior.
Loaded modules: libraries and other components loaded into the process.
Related process details: parent information, identifiers, and other evidence useful for correlation.

These details help confirm that you have selected the intended process and help explain its behavior before you suspend, restart, or terminate it.

Searching online for a process

Search Online performs a web search for the process name. This can provide useful background, but a name-only search is ambiguous. Malware can use a name resembling a legitimate Windows component, and many unrelated programs can share generic names.

Verify search results against the exact executable path, publisher, digital signature, hash, and command-line arguments. Do not treat generic search results as authoritative evidence that a process is safe or malicious.

Safe process-action workflow

Step	Action	Purpose	When to proceed to the next step
1	Inspect Properties and the process tree.	Identify the PID, path, command line, owner, parent, children, and activity.	Proceed when the process identity and impact are understood.
2	Try a Window action if a visible window exists.	Bring the application forward or close it normally.	Proceed when the window is unavailable or normal closing fails.
3	Consider a minidump or full dump.	Capture evidence before changing or ending a problematic process.	Proceed when evidence is sufficient or immediate recovery is required.
4	Use Suspend briefly, when safe.	Assess whether the process is causing resource pressure or a visible effect.	Resume it, collect evidence, or follow an approved escalation procedure.
5	Restart the process.	Recover a stalled user process when relaunch behavior is understood.	Proceed only if interruption is acceptable and restart is supported.
6	Use Kill Process or Kill Process Tree.	Force recovery when normal options fail.	Use only after validating identity, dependencies, permissions, and data-loss risk.

This least-disruptive-first order is a guideline, not an absolute rule. A security incident, critical resource exhaustion, or an approved operational procedure may require a different sequence.

Avoid acting on unknown Windows components, security software, service hosts, or business-critical processes without validation. Protected or elevated processes may require sufficient administrative rights, and some processes cannot be safely modified even with those rights.

For support work, document the process name, PID, executable path, command line when relevant, action taken, time, permission context, and observed result. This record makes troubleshooting repeatable and helps distinguish a successful recovery from a process that merely restarted or moved its activity elsewhere.

Practical examples

Recovering a frozen desktop application

Select the suspected application process and open Properties. Confirm its executable path, publisher, PID, and identity.
If it owns a visible window, try bringing it forward and then closing it normally.
If normal closing fails, capture a dump if support or development needs evidence.
Use Kill Process only when recovery is necessary and the consequences are understood. Confirm that unsaved work may be lost.

Stopping an application and its helper processes

Expand the process tree and identify the main application and its child processes.
Compare Kill Process, which ends only the selected process, with Kill Process Tree, which also targets descendants.
Use the tree action only after validating that the helpers belong to the operation being stopped. Ending the parent alone may leave helpers running.

Capturing evidence before ending a hung application

Select the nonresponsive process and inspect its properties.
Create a minidump for a lightweight troubleshooting artifact, or a full dump when deeper memory analysis is needed.
Store the dump securely because it may contain sensitive application data.
Restart or terminate the process afterward if necessary and permitted.

Testing a CPU-related compatibility issue

Record the current state and select Set Affinity.
Temporarily choose a limited subset of logical processors.
Observe whether the application's behavior changes.
Restore normal affinity after testing. The restricted setting can reduce performance.

Investigating an unfamiliar process

Review Properties, including image location, command line, parent process, publisher, signature, and hash where available.
Use Check VirusTotal as one evidence source, while considering privacy and network policy.
Use Search Online carefully and compare results with the exact executable identity rather than its name alone.

Temporarily reducing the impact of a runaway workload

Identify the process responsible for resource pressure and confirm its ownership.
Suspend it briefly to assess the effect or free resources for immediate investigation.
Resume it if continued operation is required, or collect a dump and follow an approved escalation or termination procedure.

Troubleshooting common problems

Window commands are unavailable

The process may have no visible desktop window, may be a background process or service, or the visible application may be owned by another process. Inspect the process tree and Properties to find the process associated with the window. If no window exists, use process-level actions instead.

A process cannot be terminated or modified

Insufficient permissions, a higher-integrity security context, protection mechanisms, or the critical nature of the component may prevent the action. Confirm the process identity and criticality, obtain appropriate administrative authorization where permitted, and avoid forced actions against essential Windows processes.

The application remains partly active after its main process ends

Child or helper processes may still be running, or related processes may not be direct children. Review the process tree and validate remaining processes by path, command line, and ownership. Use Kill Process Tree where appropriate, rather than terminating unrelated processes based only on similar names.

System responsiveness worsens after raising priority

The process may be consuming excessive CPU at elevated priority, starving other applications or system tasks. Return it to a normal priority and investigate the underlying high-CPU behavior.

A VirusTotal result is confusing

A detection may be a false positive or heuristic result, a legitimate executable may share a generic name with malware, or the file may be running from an unusual location. Correlate the result with the path, signature, hash, parent process, and command line. Do not decide solely from a process name or one detection.

A dump is too large or contains sensitive information

A full dump includes extensive process memory, which can contain documents, credentials, tokens, or other private data. Use a minidump when sufficient, and apply secure storage, access controls, and approved sharing procedures to every dump.

For a concise reference, return to Process Actions in Process Explorer after practicing the least-disruptive-first workflow.