View Process Properties in Process Explorer
Learn how to open Process Explorer Process Properties and use its tabs to inspect process identity, performance, threads, security, network activity, services, and more.
Process Explorer is a Windows process-inspection utility that displays running processes and detailed information about them. The Process Properties dialog is the per-process window for examining one selected process in greater depth than the main process list.
Properties can help you verify an executable's identity, investigate CPU and memory usage, inspect threads, examine network activity, review the security context, view environment variables, identify loaded components, and determine which services are associated with a process.
Open a Process Properties Window
- Start Process Explorer and locate the target process in the main window.
- Select the process.
- Double-click the process to open its Process Properties window.
Identify the process carefully before interpreting its data. Several processes may have the same display name, and a parent process, child process, helper process, or service-host process may be the one you actually need to investigate. Confirm the executable path and command line on the Image tab before drawing conclusions or collecting diagnostic data.
For related navigation techniques, see Process Explorer tree navigation and identifying the process that owns a window.
Modeless Window Behavior
A Process Properties window is modeless. A modeless window remains open without blocking interaction with the main application or other windows. You can continue using the main Process Explorer window while properties are displayed.
You can also open several Process Properties windows at once. This is useful when comparing an application with its helper process or examining a parent and child process side by side. Keep the first properties window open, select another process in the main list, and double-click it to open another window.
Process Properties Tabs
The dialog uses a tabbed layout. The tabs and the data available on them can vary with the Windows version, Process Explorer version, process type, and your permissions. An empty or missing tab does not automatically indicate a problem.
| Tab | Primary information shown | When to use it | Availability considerations |
|---|---|---|---|
| Image | Executable identity, path, command line, start information, parent-process context, and verification or signature details where available. It may also provide process actions such as creating a dump. | Confirm that you selected the correct executable and understand how it was launched. | Some identity, verification, or action details may require access to the image or process. |
| Performance | Current and aggregate resource values, including CPU use, memory-related values, handles, and I/O counters. | Establish how heavily a process is using system resources. | Values depend on available counters and permissions. |
| Performance Graph | Time-based graphs for resource consumption. | Observe whether CPU, memory, or other activity is sustained, intermittent, or increasing. | Graph categories and telemetry vary by version and process. |
| GPU Graph | Graphics processor usage for processes using supported GPU telemetry. | Investigate rendering, compute, video, or other GPU-related activity. | Only useful when the process uses a supported GPU path and telemetry is available. |
| Threads | Individual threads, CPU activity, start addresses, and thread-level inspection information. | Find threads that may account for high CPU use or unusual execution. | Detailed thread inspection can be restricted by permissions or process protections. |
| TCP/IP | Active TCP/IP endpoints, local and remote addresses, ports, and connection details associated with the process. | Check whether the process has active network connections. | An empty view may mean no current connections, unavailable telemetry, or insufficient access. |
| Security | Process owner, security token, groups, privileges, integrity level, and related security context. | Determine which account runs the process and what security rights it has. | Security details are permission-sensitive. |
| Environment | Environment variables inherited or defined for the process. | Investigate configuration passed through name-value settings such as paths, modes, or runtime options. | Visibility can depend on access to the target process. |
| Strings | Discoverable text strings associated with the process image or memory. | Look for readable names, paths, URLs, messages, or other clues during an investigation. | Results are not proof of behavior; strings may be unused, incomplete, or absent. |
| Disk and Network | Disk and network activity measurements and related throughput details. | Relate a process to file-system load or broader network throughput. | Data depends on supported operating-system telemetry and current activity. |
| .NET Assemblies | Managed assemblies loaded by a .NET process. An assembly is a deployable .NET component, commonly a DLL or executable. | Identify loaded managed components during .NET troubleshooting. | Relevant primarily to eligible managed processes. |
| .NET Performance | Managed-runtime performance information for eligible .NET processes. | Investigate .NET runtime behavior and performance. | Not applicable to native processes or unsupported runtime configurations. |
| Services | Windows services hosted by or associated with the selected process. | Relate a service to its hosting process during service troubleshooting. | Empty data is expected when the process hosts no services or the relationship cannot be read. |
Important Terms in the Dialog
- Process owner: The user account or security principal under which a process runs.
- Thread: An execution unit within a process. One process can contain many threads.
- TCP/IP endpoint: A local or remote network address and port used by a process for communication.
- Environment variable: A name-value setting passed to a process that can influence program behavior.
- Security token: The Windows security context containing the process identity, groups, privileges, and integrity information.
- Integrity level: A Windows mandatory-integrity-control level that affects what a process can access or modify.
- Assembly: A deployable .NET component, commonly a DLL or executable, loaded by a managed process.
Administrative Access and Permissions
Much of the detailed process information is permission-sensitive. A standard-user Process Explorer session generally provides its best visibility into processes owned by that same user. System processes and processes owned by other users may expose only limited information.
Elevation means running an application with administrative permissions through Windows User Account Control. If you are authorized to inspect system processes or another user's process, start Process Explorer with elevated rights using Run as administrator, then reopen the properties window and recheck the data.
Do not confuse lack of access with a process having no data for a tab. A permission problem may hide information, while an empty applicable tab may simply indicate that the process has no current activity in that subsystem. Even administrators may encounter limits with a protected process, which is subject to additional Windows protections that can restrict inspection.
Why Information May Be Empty or Unavailable
| Symptom | Likely cause | Recommended response |
|---|---|---|
| Process belongs to another user | The current session does not have full access to that process. | Verify the owner and use an elevated session if authorized. |
| Process Explorer is not elevated | Administrative access is needed for some system or cross-user details. | Rerun Process Explorer with appropriate elevation, then check again. |
| Selected process has no activity in that subsystem | The process currently has no network, GPU, disk, or other relevant activity. | Check again while the workload is active and use Image and Performance as general starting points. |
| Process is not a .NET application | .NET-specific tabs do not apply to a native process. | Use the general tabs, or select an eligible managed process for .NET diagnostics. |
| Process hosts no services | No Windows service is associated with the selected process. | Confirm the process identity and investigate the Services tab only for service-hosting processes. |
| Operating system or Process Explorer version does not expose the data | The required telemetry or feature is unavailable. | Check other tabs and interpret the result within the capabilities of the installed versions. |
| Process is protected or otherwise access-restricted | Windows protection limits inspection, sometimes even for administrators. | Respect the restriction and use permitted diagnostic sources. |
Investigation Workflows
Compare an application with its helper process
- Open properties for the main application.
- Leave that modeless window open and open properties for the helper process.
- Compare executable paths, command lines, process owners, resource usage, and parent-process relationships.
The Image and Security tabs help establish identity and ownership, while Performance and Performance Graph help show whether one process is responsible for the observed load.
Investigate high CPU use
- Identify the high-CPU process in the main Process Explorer list.
- Open its properties and review Performance for current and aggregate values.
- Use Performance Graph to determine whether the activity is continuous or temporary.
- Open Threads to see whether one or more threads account for the activity.
For deeper thread work, see the Threads tab guide.
Check for network activity
- Open properties for the selected process.
- Inspect TCP/IP for active endpoints and connection details.
- Review Disk and Network for related activity and throughput measurements.
An empty TCP/IP view can mean that there are no active connections at that moment. It can also reflect unavailable telemetry or insufficient access, so interpret it with the process owner and permissions in mind. See TCP/IP inspection for related investigation.
Determine why inspection is limited
- Open the properties window as a standard user and note which details are missing.
- Check the process owner on the Security tab when available.
- If permitted, restart Process Explorer with elevation.
- Recheck the properties and decide whether the remaining limitation is permission-related or simply not applicable to the process.
Prepare diagnostic data
First confirm the target using the Image tab, then review performance and loaded-component information. An advanced action is creating a process dump, a captured snapshot of process memory and execution state for later debugging or analysis. Use dumps only when appropriate and authorized. They can contain credentials, documents, session data, or other sensitive memory contents, so store and share them securely. See creating process dump files for the related procedure.
Recommended Investigation Order
- Select a suspicious or resource-intensive process in the main list.
- Open its properties by double-clicking it.
- Start with Image to confirm the executable, path, command line, and parent context.
- Review Performance and Performance Graph for resource behavior.
- Use specialized tabs such as Threads, TCP/IP, Security, Environment, GPU Graph, .NET, or Services according to the question being investigated.
- Confirm permissions before treating missing information as evidence that no activity exists.
- Collect a process dump only when the diagnostic need, authorization, and secure handling plan are clear.