Process Explorer Keyboard Shortcuts

Learn Process Explorer keyboard shortcuts for process inspection, lower-pane views, searching, refreshing, exporting, column sets, and safe process control.

Process Explorer is a Windows process-inspection utility that displays running processes and associated details. Its keyboard shortcuts provide faster access to monitoring, inspection, searching, exporting, refreshing, and process-control actions.

A shortcut may apply to the main process list, the lower pane, or the currently selected process. Before using a process-specific command, confirm that the correct process or lower-pane row is selected.

Complete Process Explorer keyboard shortcut reference

Ctrl+A — Save the displayed data to a new file. Applies to the displayed Process Explorer dataset.
Ctrl+C — Copy the current row from the main process list or lower pane. This copies a row rather than exporting the complete displayed dataset.
Ctrl+D — Display DLL view in the lower pane.
Ctrl+F — Find a handle or DLL. This performs a local search through Process Explorer information.
Ctrl+H — Display Handle view in the lower pane.
Ctrl+I — Open System Information.
Ctrl+L — Show or hide the lower pane.
Ctrl+M — Search online for information about the selected process.
Ctrl+R — Start a new process from within Process Explorer.
Ctrl+S — Save the displayed data to a file.
Ctrl+T — Show the process list in tree view.
Ctrl+1, Ctrl+2, and higher numbers — Load the corresponding saved column set, such as the first or second configured layout.
Space — Pause or resume automatic updating.
Delete — Terminate the selected process.
Shift+Delete — Terminate the selected process tree.
F1 — Open Process Explorer Help.
F5 — Refresh the displayed information manually.

Saving and copying displayed information

Use Ctrl+C when you need a quick copy of the active row. The active row can be in the main process list or in the lower pane. This is useful for placing one process, handle, or DLL result into a ticket or report.

Copying one row is different from saving the displayed dataset. Use Ctrl+A to save the displayed data to a new file, or Ctrl+S to save displayed data to a file. These commands are better suited to broader evidence collection or later analysis.

The exact save dialog and available file choices can depend on the Process Explorer version and the view currently being displayed. Confirm the destination and review what information is included before sharing a saved capture.

Lower-pane display controls

The lower pane is the secondary Process Explorer panel used to inspect information related to the selected process. It can expose objects or modules associated with that process.

Show or hide lower pane — Ctrl+L: Toggle the secondary panel.
Handle view — Ctrl+H: Display handles associated with the selected process.
DLL view — Ctrl+D: Display loaded dynamic-link libraries and related modules.
Handle or DLL search — Ctrl+F: Search locally for a handle or DLL name and review matching processes.

A handle is a reference a process uses to access a system resource or object. A DLL is a Dynamic Link Library loaded by a process. These views answer different diagnostic questions: Handle view helps investigate open objects, while DLL view helps investigate loaded libraries and modules.

For more detail about DLL inspection, see DLL View. For broader process operations, see Process Actions.

Example: inspect modules loaded by a suspicious application

Select the process in the main list.
Press Ctrl+L if the lower pane is hidden.
Press Ctrl+D to switch to DLL view.
Review the displayed module information and continue the investigation using the relevant process or module details.

Searching locally and looking up a process online

Ctrl+F opens a local Handle/DLL search. Enter an identifying file, handle, or DLL name, then review the matching processes and inspect the relevant result. This search is useful when you know the resource or library and want to find which process is associated with it.

Ctrl+M searches online for information about the selected process. It starts with the process currently selected in the main list and is different from a local handle or DLL search. The online lookup may require suitable network access and may not provide useful results for every filename.

If an online lookup is unavailable or unhelpful, verify the selected process and continue with local evidence such as its properties, handles, DLLs, copied rows, or saved data.

Example: find which process uses a known file or library

Press Ctrl+F to open the Handle or DLL search.
Enter an identifying file, handle, or DLL name.
Review matching processes and inspect the relevant result in the main list or lower pane.

Process-list and system-monitoring controls

Automatic updating is the periodic refresh of displayed process and system data. Press Space to pause or resume it. Pausing can make a rapidly changing process list easier to inspect because rows do not continually change while you read them.

While updates are paused, the display may no longer represent the current system state. Press Space again to resume current data collection. Press F5 to request a manual refresh of the displayed information when you need an immediate update.

Press Ctrl+I to open System Information, a dialog that presents system-level activity and performance information. See System Information Window for related details.

Press Ctrl+T to toggle the process list's tree view. A tree view is a hierarchical display that reveals parent-child relationships between processes.

Example: capture process-list evidence for a support case

Press Space if a stable view is needed.
Select a relevant row and press Ctrl+C for a quick report.
Press Ctrl+A to save the displayed data to a new file, or Ctrl+S to save it to a file.
Press Space again when finished to resume updating.

Starting a new process

Process Explorer can start a new process through its interface. Press Ctrl+R to open the command for starting a process, then provide the application or document information requested by the interface.

This shortcut launches a process through Process Explorer; it does not require inventing or relying on undocumented command-line parameters. For a focused walkthrough, see Run Processes From Procexp.

Terminating a process or process tree

A process is an executing program instance shown in the main process list. A process tree is a parent process together with the child processes it started.

Terminate selected process — Delete: Ends only the selected process.
Terminate process tree — Shift+Delete: Ends the selected process and its child-process tree.
Pause automatic updates — Space: Stops or resumes periodic display updates; it does not terminate anything.
Manual refresh — F5: Requests a new display refresh; it does not resume updates if automatic updating remains paused.
Start a new process — Ctrl+R: Opens the interface for launching a process.

Example: end an unresponsive application

Select the target process.
Use Delete only when ending the selected process is sufficient.
Use Shift+Delete only when child processes must also be ended.
Assess the potential impact before confirming termination.

For additional process-termination guidance, see Kill A Process.

Column-set shortcuts

A column set is a saved arrangement of visible columns in the process list. Different layouts can support different tasks, such as routine monitoring, performance investigation, or process identity checks.

Press Ctrl+1 to load the first configured column set, Ctrl+2 to load the second, and so forth. The available higher-numbered shortcuts depend on the configured column-set slots in the installed version.

Example: use a diagnostic-specific list layout

Press Ctrl+1, Ctrl+2, or another available Ctrl+number combination.
Choose the layout that exposes the information needed for the current investigation.
If the shortcut produces no expected layout, verify that the corresponding numbered column set has been configured.

Practical troubleshooting

The lower pane is not visible: Press Ctrl+L to toggle it back on, then press Ctrl+H for Handle view or Ctrl+D for DLL view.
The process list appears frozen or outdated: Check whether Space paused automatic updating. Press Space to resume, or press F5 for an immediate refresh.
Parent-child relationships are not visible: Press Ctrl+T to enable tree view.
The wrong information is visible in the lower pane: Use Ctrl+H for open objects and handles, or Ctrl+D for loaded libraries and modules.
Terminating one process did not stop spawned children: Review the hierarchy in tree view and, only after assessing impact, use Shift+Delete if the full tree must be ended.
A column shortcut does not show the expected layout: Verify that the matching numbered column set is configured, then select the intended Ctrl+number slot.
Online lookup is not useful: Verify the selected process and network access where applicable. Use local handles, DLLs, copied rows, or saved data for further analysis.

Command-line switches

Process Explorer can support command-line switches, but switch syntax and availability can vary by installed version. Verify the supported switches against the installed version's built-in Help or its official version-specific documentation.

Do not assume that a switch documented for another release is available or has the same meaning in your installation. If you cannot verify a switch from an authoritative source, use the Process Explorer interface instead of relying on unconfirmed syntax.

Help access

Press F1 to open Process Explorer Help. Use Help to confirm behavior that may depend on the installed version, including column-set availability, save behavior, and command-line switches.

For a broader learning path, see the Process Explorer Course.