Process Actions in Process Explorer
Learn how to inspect, control, troubleshoot, suspend, restart, terminate, and create dumps for Windows processes using Process Explorer actions.
Process Explorer provides administrative and diagnostic controls through the context menu for a selected process. A process is a running instance of a program managed by Windows. To open its actions, locate the process, select it, right-click it, and choose an action or submenu.
Some actions are conditional. The available choices can vary according to the process state, your permissions, the process owner, and whether the process owns a qualifying desktop window. Actions affecting protected or elevated processes may require running Process Explorer with administrative permissions. See Run Process Explorer as administrator when access is denied.
Understand the process tree first
A process tree displays parent-child relationships. A parent process launches or is associated with one or more child processes, while a child process is started by another process. For example, a launcher may start an application process, which then starts update, rendering, or helper processes.
Tree relationships matter before using Kill Process Tree. Killing one selected process affects only that process, while tree termination can affect the selected process and its descendants. Expand the tree and verify which processes belong to the workload before choosing a broad action.
Open process actions
- Locate the target process in Process Explorer.
- Select the process row.
- Right-click the row to open its context menu.
- Choose the required action or open a submenu.
Verify the process identity before making a change. Compare its name with its executable path, command line, user account, parentage, publisher, and observed behavior. A familiar-looking process name is not enough to establish that a process is safe or that it is the process you intended to control.
Window management actions
The Window submenu applies to a process that owns a visible desktop window. It can provide commands to bring the window to the foreground, restore it, minimize it, maximize it, or close it.
- Bring to front or foreground: makes the application window the active visible window.
- Restore: returns a minimized or maximized window to its normal state.
- Minimize: reduces the window to the taskbar or minimized state.
- Maximize: expands the window to occupy the available desktop area.
- Close: requests that the application close its window normally.
Window actions are unavailable when the selected process has no qualifying visible window. Background processes, services, helper processes, and some console-related components may not own a controllable desktop window. If the application window belongs to another process, identify that owner before using window controls. The process that owns a window can be different from a helper process visible in the same application tree.
Closing a window is not the same as forcibly terminating a process. A normal close gives the application an opportunity to save data and clean up. Kill Process ends the process without relying on normal application shutdown.
Set processor affinity
Processor affinity restricts a process's threads to selected logical processors. A logical processor is a CPU execution unit exposed to Windows, including physical cores and hardware threads. On a multi-core or multi-CPU system, affinity determines which of those units the process may use.
- Right-click the target process.
- Select Set Affinity.
- Select the logical processors on which the process may run.
- Apply the selection and observe CPU use, throughput, and application behavior.
Affinity can help with controlled performance tests, compatibility investigations, or experiments that isolate a workload. It is not normally a general performance fix. Restricting a demanding process to too few logical processors can reduce throughput, increase latency, and make its threads compete for limited CPU time. Restore a broader selection after testing unless the restriction is intentional and documented.
Set process priority
Base priority is the process scheduling priority used as a basis for how Windows favors the process for CPU execution relative to other runnable work. Process Explorer allows you to change this through the process action menu, commonly using Set Priority.
A higher priority may make a process receive CPU scheduling preference, but it does not create additional CPU capacity. Raising priority can reduce system responsiveness or starve interactive applications, drivers, and other important work. Use a changed priority cautiously and temporarily when diagnosing responsiveness problems. Return it to a normal setting after the test and investigate the underlying CPU bottleneck rather than treating priority as a permanent cure.
Terminate one process
Kill Process forcefully terminates the selected process. It can be useful when an application is unresponsive, unwanted, or preventing a necessary recovery action. Process Explorer requests confirmation before termination; read the identity and confirm that the selected process is the intended target.
Forceful termination can discard unsaved work, interrupt file or network operations, leave application state inconsistent, and cause instability when other components depend on the process. Targeting a critical Windows process can also cause system-wide disruption. If a normal window close is possible, try it first. When you need diagnostic evidence from a reproducible hang, create a dump before killing the process.
Terminate a process tree
Kill Process Tree forcefully terminates the selected process and its descendant processes. It is useful when an application launcher has created several helper processes and killing only the launcher leaves the workload running.
| Choice | Processes affected | Best use case | Main risk |
|---|---|---|---|
| Kill Process | Only the selected process | End one confirmed unresponsive or unwanted process | Child or helper processes may remain active |
| Kill Process Tree | The selected process and its descendants | Stop a confirmed application workload and its helpers | Multiple tasks may close, causing broader data loss or service disruption |
Before using tree termination, expand the process tree and confirm that every descendant belongs to the affected workload. A shared or independently useful child process may be harmed by a broad termination.
Restart a process
Restart ends the selected process and launches it again. This can recover an ordinary user application after a failure, stuck state, or configuration change that requires a fresh process.
Restart behavior depends on the process executable information available to Process Explorer and Windows. A restarted process does not retain unsaved work or in-memory state. Restarting a managed service or system component is different from restarting a normal desktop application: service dependencies, recovery policies, permissions, and system stability must be considered. Use the appropriate service-management procedure for managed services rather than assuming that a process restart is equivalent to a service restart.
Suspend and resume
Suspend temporarily stops a process from executing. Resume allows a suspended process to run again. Suspension can be a useful reversible diagnostic control: for example, suspend a background application during resource troubleshooting, observe whether CPU or memory pressure changes, and then resume it.
- Right-click the process and select Suspend.
- Observe the application and system while it is inactive.
- Right-click the same process and select Resume when the test is complete.
A suspended process may freeze its window, stop responding to requests, hold files or other resources, or block processes that depend on it. Suspending a companion process can make the whole application appear frozen. If an application suddenly appears stuck after an action, identify suspended processes in Process Explorer and choose Resume for the intended process. Check related processes if the application remains affected.
Create process dumps
A memory dump captures process state for later debugging or investigation. It can preserve evidence of a hang, crash, abnormal memory use, or a problem that developers or support staff cannot reproduce immediately.
- Right-click the affected process.
- Open Create Dump.
- Choose a minidump or full memory dump.
- Save the file in an approved, secure location.
| Dump type | Relative size | Information depth | Suitable scenarios | Handling considerations |
|---|---|---|---|---|
| Minidump | Smaller and faster | Limited crash or process-state information | Initial support requests, basic crash analysis, and cases where a smaller artifact is sufficient | Easier to store and transfer, but may omit memory needed for deeper analysis |
| Full memory dump | Larger and slower | Substantially more process memory data | Complex hangs, deep debugging, and abnormal memory investigations | Requires more disk space and stricter privacy, transfer, and retention controls |
Dumps can contain passwords, tokens, document contents, messages, personal data, and other information held in application memory. Treat them as sensitive data. Before capturing or sharing a dump, consider storage encryption, access control, organizational policy, data-transfer limits, and retention requirements. If a full dump is too large, use a minidump when it meets the diagnostic goal, or obtain approved secure storage first. For more focused guidance, see Create dump files.
Check VirusTotal
VirusTotal is an external service that provides file reputation and multi-engine malware scanning information. The Check VirusTotal action looks up the file associated with the selected process, where the action and network policy permit it.
Detection results are reputation and scanning signals, not conclusive proof of malware. False positives can affect legitimate, unsigned, uncommon, custom, or newly released software. Conversely, a clean result does not prove that a process is safe. Validate the executable path, publisher, digital signature, hash context, parent process, command line, and behavior. Organizational privacy and network policies may prohibit uploading or externally checking files, so follow policy before using the action.
Properties and online search
Properties is the central location for detailed process information. Depending on the process and permissions, useful investigation categories include:
- Executable path and image identity
- Command line and launch arguments
- Parent process and process-tree relationships
- User account, integrity level, and security details
- Loaded modules, DLLs, and handles
- CPU, memory, thread, and other performance activity
- Image verification, publisher, and signature information where available
Use Process Properties to correlate identity with runtime behavior. Search Online performs a web search based on the process name. It can provide supplemental context, but a process name alone is insufficient for a trust decision because names can be duplicated, misleading, or deliberately chosen to resemble legitimate software. Combine search results with path, signature, parentage, account, command line, and observed behavior.
Process actions overview
| Action | What it does | Typical use | Potential impact | Key precaution |
|---|---|---|---|---|
| Window actions | Controls a qualifying visible window | Bring forward, restore, minimize, maximize, or close an application | Changes the user interface or requests normal application closure | Unavailable for processes without a qualifying window |
| Set Affinity | Limits execution to selected logical processors | Testing, compatibility investigation, or workload isolation | Reduced performance or CPU contention | Use deliberately and restore settings after testing |
| Set Priority | Changes base scheduling priority | Temporary responsiveness diagnosis | System sluggishness or starvation of other work | Do not use elevated priority as a routine optimization |
| Kill Process | Forcefully terminates one process | End a confirmed hung or unwanted process | Data loss, interrupted work, or system impact | Verify identity and try normal close first |
| Kill Process Tree | Terminates a process and descendants | Stop a launcher and all confirmed helpers | Multiple applications or services may be affected | Inspect the tree before confirming |
| Restart | Ends and launches the process again | Recover an ordinary application after failure | Unsaved state is lost; service behavior may differ | Confirm executable information and process role |
| Suspend | Temporarily stops process execution | Reversible resource or behavior testing | Frozen windows, held resources, or blocked dependencies | Resume it after the test |
| Resume | Allows a suspended process to execute | Recover from intentional or accidental suspension | Workload resumes immediately | Check related suspended processes if needed |
| Create Dump | Captures process state for analysis | Hangs, crashes, memory problems, and support cases | Consumes storage and may expose sensitive memory | Choose dump depth and secure the file |
| Check VirusTotal | Checks file reputation through an external service | Initial suspicious-file triage | Privacy or policy concerns; ambiguous results | Corroborate detections with local evidence |
| Properties | Displays detailed identity and runtime information | Process investigation and troubleshooting | Primarily observational | Use multiple fields, not just the name |
| Search Online | Searches the web using the process name | Find supplemental background information | Misleading or incomplete results | Do not treat name-based search as proof |
Safe operational workflow
- Identify: select the correct process and verify its name, path, user, and command line.
- Inspect: open Properties and review parentage, children, signatures, modules, handles, and performance activity as relevant.
- Assess impact: determine whether the process owns a visible window, supports another application, belongs to a service, or is critical to Windows.
- Choose the least disruptive action: use a window close before forceful termination; use Suspend for a reversible test; use a dump before ending a reproducible hung process.
- Apply the action carefully: confirm dialogs, affinity selections, priority changes, and dump destinations.
- Verify: check whether the process ended, resumed, restarted, or changed resource use. Inspect child processes, CPU and memory activity, and application behavior.
Practical troubleshooting examples
An application window is visible but unresponsive
Use the Window submenu to bring the window forward or restore it, then attempt a normal close. If it remains hung and diagnostic evidence matters, inspect Properties and create a suitable dump before using Kill Process. If preserving evidence is unnecessary, verify the process identity and terminate only the affected process.
A parent application leaves helper processes running
Expand the process tree and identify the descendants. Killing only the selected parent may leave helpers active. Compare that result with Kill Process Tree, and use tree termination only after confirming that all descendants belong to the affected workload and can safely be closed.
A CPU-intensive test must use selected CPUs
Open Set Affinity, select a limited set of logical processors, and observe throughput, latency, and CPU utilization. Restore a broader affinity selection after the test. Affinity is a controlled testing tool, not a substitute for finding the real performance bottleneck.
A background application is consuming resources
Suspend it temporarily, observe whether resource pressure or the symptom changes, and then select Resume. If the application remains frozen, check for suspended companion or dependent processes.
A process may be unwanted software
Open Properties and validate the executable path, command line, parent, user, publisher, and signature. Use VirusTotal if organizational policy permits, and use Search Online only for additional context. Do not terminate or delete software solely because of one process-name match or one detection result; escalate uncertain cases through the security process.
A developer needs evidence of an intermittent hang
Capture a minidump when a smaller artifact is adequate. Capture a full memory dump when deeper inspection is required and storage and privacy controls allow it. Preserve the dump before restarting or terminating the process, because those actions destroy the original runtime state.
Common problems and recovery
The Window submenu is unavailable
The process may not own a visible desktop window. It may be a background process, service, helper, or console-related component without a controllable window. Inspect Properties, locate the actual window-owning process if necessary, and use inspection, dump capture, suspension, or termination only when appropriate.
Killing one process did not stop the workload
Child or helper processes may still be running, or the selected process may not have been the primary parent. Inspect the process tree and confirm ownership before considering Kill Process Tree.
The system became less responsive after raising priority
The target may be receiving too much CPU scheduling preference. Return it to a safer priority and investigate the underlying CPU demand. Avoid elevated priority as a routine remedy.
The application appears frozen after an action
The process, or a dependency, may have been suspended. Identify suspended processes and select Resume. If necessary, resume related processes after confirming their relationship and role.
VirusTotal results look concerning, but the file may be legitimate
False positives can affect custom, unsigned, newly released, or uncommon software. Validate the path, signature, publisher, hash context, parent, and organizational software source. Escalate through the relevant security process instead of acting on a single signal.
A dump is too large to store or transfer
A full memory dump from a large process can consume substantial disk space and may exceed transfer or retention limits. Use a minidump when it satisfies the investigation, or use approved secure storage and review data-handling requirements before capturing a larger dump.