VMware ESXi and vSphere Cluster Management

Viewing Process Properties in Process Explorer

Learn how to open and interpret the Process Properties dialog for a Windows process, including performance, threads, network, security, .NET, and service details.

Process Explorer is a Windows process-inspection utility that provides detailed information about running processes. A process is an executing instance of a program. The main Process Explorer window gives you an overview of many processes, while the Process Properties dialog provides detailed attributes, activity, and runtime context for one selected process.

This lesson explains how to open that dialog, understand its modeless behavior, work with permissions, and choose the appropriate tab during an investigation.

What Process Properties Are Used For

Process Properties supplies process-specific diagnostic and configuration information beyond the columns in the main Process Explorer list. You view properties for an individual selected process, not for the entire process list.

For example, the dialog can help you answer questions such as:

• Which executable file is actually running, and what command line started it?
• Why is a process using CPU, memory, disk, or network resources?
• Which thread is consuming CPU time?
• Under which account and security context is the process running?
• Which services, network connections, or .NET assemblies are associated with it?

Opening a Process Properties Window

1. Open Process Explorer and locate the process in the main window.
2. Select the process row.
3. Double-click the process to open its Process Properties dialog.

The dialog is associated with the process selected when it was opened. Check the process name in the dialog title and the Image tab before drawing conclusions, especially when several processes have similar names.

Modeless Dialog Behavior

A modeless window remains open without preventing interaction with other windows in the same application. After opening Process Properties, the main Process Explorer interface remains usable. You can continue watching the process list while inspecting the selected process.

You can also open multiple properties dialogs at the same time. This is useful for comparing related processes, such as two instances running under different accounts or a parent process and one of its children.

Permissions and Elevation

Elevation means running a program with administrative rights. Some process details require access that a standard user does not have. When Process Explorer runs as a standard user, detailed visibility is generally greatest for processes owned by that user.

If you are authorized and need information about another user's process or a process requiring elevated access, run Process Explorer with administrative rights. Even an elevated instance may not expose every detail for protected or restricted processes because Windows applies additional access controls.

How the Tabs Organize Process Information

The Process Properties dialog uses tabs to organize identity, resource, execution, security, configuration, network, runtime, and service information. The exact tab set and fields vary with the Windows version, Process Explorer version, process type, installed components, current activity, and available permissions.

The following tabs are documented for the Windows 8.1-era context and may not all appear in a newer or different environment.

Image Tab

The Image tab is the primary identity and launch-information view for the executable process. An executable image is the program file and associated launch identity represented by the running process.

Depending on the version and permissions, inspect:

• The executable image name and full path.
• The command line, meaning the executable invocation and its arguments.
• The current directory.
• The parent process relationship. A parent process is the process that launched or is associated with creating another process.
• The process owner, which is the user account under which the process runs.
• The process start time.
• Applicable verification, signature, version, or other metadata fields.

These details distinguish similarly named processes. For example, a familiar filename launched from the expected application directory may be legitimate, while a copy with the same name in an unexpected directory or with an unusual command line deserves further investigation. Path and command-line evidence should be correlated with account, parent, signature or metadata, and observed behavior.

Performance Tab

The Performance tab presents current and cumulative resource information for the selected process. Depending on the build, it can include processor usage and processor time, memory-related measures, handle counts, I/O activity, and other counters.

Interpret these as process-level measurements, not system-wide totals. A process CPU percentage describes the selected process's processor use; it does not describe total system CPU use. Similarly, a process's I/O counters describe activity attributed to that process, not all disk or network activity on the computer.

Performance Graph Tab

Performance Graph displays time-based graphs for selected process metrics. Graphs make patterns visible that a single current-value reading can hide.

• A short spike can indicate a brief operation, startup work, or an event-driven task.
• Sustained CPU usage can indicate a loop, busy workload, or inefficient operation.
• Repeated memory growth can suggest a workload pattern that warrants further investigation.
• Periodic I/O peaks can correspond to polling, logging, caching, or scheduled work.

Use the graph with the current values and the Threads tab. A graph shows when the process is busy; thread inspection can help show which execution unit is responsible.

GPU Graph Tab

The GPU Graph tab shows GPU-related utilization or activity history when that information is available. It can associate graphics workload with a particular process, such as a game, video application, browser tab, or computer-aided design tool.

This tab is conditional. Its availability depends on the Windows version, graphics driver support, actual process activity, and Process Explorer version. An absent or empty GPU view does not by itself prove that a process never uses graphics hardware.

Threads Tab

A thread is an execution unit within a process. The Threads tab lets you inspect activity at that finer level.

Available information can include thread identifiers, CPU use or CPU time, thread state, start address, and stack information. Stack inspection may depend on access, symbols, and tool support.

Thread analysis is useful when a process is busy but its overall identity does not explain why. A thread with unusually high CPU use may identify the execution path responsible for a sustained load. A blocked or waiting state can help explain apparent inactivity or responsiveness problems.

TCP/IP Tab

The TCP/IP tab shows network connections and listening endpoints owned by the selected process, where available. A TCP/IP endpoint is a local or remote network address and port associated with communication.

Inspect local and remote endpoint information, protocol, and connection state. This connects a network observation to the responsible process instead of relying only on a filename or application assumption. The view reflects connections visible at inspection time; a process may perform network work before or after the dialog is checked.

Security Tab

The Security tab describes the process security context and token-related information. A Windows security token contains identity, group, privilege, and integrity information used when the process accesses protected resources.

Depending on access and version, inspect:

• User identity and account context.
• Group memberships.
• Enabled or available privileges.
• Integrity level.
• Other related security attributes.

Comparing Security information between two processes can explain why one can access a file, registry location, device, or service while another cannot.

Environment Tab

The Environment tab lists environment variables inherited or assigned to the process. An environment variable is a named value supplied to a process that can influence application behavior.

Environment values can affect executable lookup through path settings, runtime configuration, proxy behavior, temporary locations, and application startup. When two instances behave differently, compare their environment values rather than assuming that the executable alone explains the difference.

Strings Tab

The Strings tab scans or lists readable text associated with the process image and memory, subject to Process Explorer's behavior and access. A string is readable text found in an executable or process memory.

Strings may reveal file paths, URLs, configuration labels, error messages, loaded component names, or other clues. Treat them as evidence for further investigation, not proof of current behavior or maliciousness. A string can be unused, left over from a library, or present only in an inactive code path.

Disk and Network Tab

The Disk and Network tab provides process-specific activity information when present. Use it to connect resource consumption to file I/O or network transfer behavior.

This differs from the TCP/IP tab. TCP/IP focuses on connection and endpoint details, such as addresses, ports, protocols, and states. Disk and Network focuses on activity measurements, such as data movement or I/O attributed to the process. A process can show activity without a currently listed TCP connection, and a connection can exist without significant transfer at the moment of inspection.

.NET Assemblies Tab

A .NET assembly is a managed code component loaded by a .NET application. The .NET Assemblies tab can show managed assemblies loaded by an eligible process, including assembly identity and location details where presented.

The tab applies only when the selected process hosts a supported .NET runtime and the needed information is available. It may not appear for a native process, and its contents can vary with runtime and tool support.

.NET Performance Tab

The .NET Performance tab provides managed-runtime performance information for eligible .NET processes. It is useful for investigating runtime behavior when the required .NET support is available.

Native processes do not host the relevant managed runtime, so this tab may not appear for them. Absence of the tab is normally a process-type or support issue, not an indication that the process is malfunctioning.

Services Tab

The Services tab lists Windows services hosted by the selected process when available. A Windows service is a background component managed by the Windows Service Control Manager.

This is especially useful for shared service-host processes. Instead of treating the host executable as one unexplained workload, you can identify the services inside it and relate those services to CPU, memory, disk, or network symptoms. The tab may be empty or unavailable for a process that hosts no Windows services.

Choosing the Right Tab

When investigating related processes, leave one properties dialog open and open another for comparison. For example, compare the Image, Security, and Environment tabs for two application instances, or compare a service host with another process showing similar activity.

Practical Investigation Examples

Identify an Unfamiliar Process with a Common Filename

1. Open the process properties by double-clicking the selected process.
2. On Image, inspect the full executable path, command line, parent relationship, and running account.
3. Compare those findings with the expected installation location and launch behavior.
4. Use available verification or metadata and then correlate the identity with resource and network activity.

A common filename is not an identity guarantee. An unexpected directory, unusual arguments, or an unexpected parent may be more informative than the name alone.

Investigate Sustained CPU Usage

1. Open properties for the process consuming CPU.
2. Review current and cumulative values on Performance.
3. Use Performance Graph to determine whether usage is a spike, sustained load, or repeating pattern.
4. Inspect Threads for a thread with unusually high CPU activity and examine its available start address or stack information.
5. Keep the properties dialog open while observing changes in the main process list.

Determine Which Application Owns a Network Connection

1. Open properties for the process associated with the suspected activity.
2. Review TCP/IP entries for local and remote endpoints, protocol, and connection state.
3. Review Disk and Network activity, if available, to determine whether the process is actively transferring data.
4. If no connection is shown, observe over time and inspect related processes.

Explain Different Behavior Between Two Accounts

1. Open properties for each process instance where access permits.
2. Compare Security information, including account, groups, privileges, and integrity level.
3. Compare Environment values for path, proxy, temporary-location, and application-specific differences.
4. Use Image to confirm that both instances have the expected executable and command line.

Find Services in a Shared Host Process

1. Open properties for the service-hosting process.
2. Use Services to identify the hosted Windows services.
3. Relate the service list to observed resource usage and troubleshooting symptoms.

Inspect a Managed Application

1. Open properties for a known .NET process.
2. Review .NET Assemblies for managed components and their locations when available.
3. Review .NET Performance when present.
4. Remember that these tabs may not appear for a native process or when runtime data is unsupported or inaccessible.

Troubleshooting Missing or Ambiguous Data

Expected Tabs or Fields Are Missing

Possible causes include an ineligible process type, a different Windows or Process Explorer version, missing permissions, or unavailable runtime or driver support. Confirm the process type, check the operating system and Process Explorer capabilities, and determine whether authorized elevation is needed.

Detailed Data Is Unavailable for Another User's Process

Process Explorer may be running without administrative rights, or the target may have restricted or protected access. Use authorized elevation when appropriate, but recognize that protected-process restrictions can remain even when Process Explorer is elevated.

A Suspicious Name Provides No Clear Conclusion

Filename alone is not reliable proof of identity. Correlate the Image path and command line with the parent relationship, account context, available signatures or metadata, and observed resource or network behavior. Strings can provide clues, but they are not proof of maliciousness or current execution.

No TCP/IP Connections Appear

The process may not have an active connection at the time of inspection. Network work may be performed by another process or service, or the activity may use a mechanism not represented as a current TCP/IP connection. Observe over time, review Disk and Network activity if available, and inspect related processes.

Scope and Version Differences

Do not assume that every listed tab or field is universally available. Process Properties views can differ on newer Windows releases and newer Process Explorer builds. A tab can also depend on the selected process, installed components, current activity, driver or runtime support, and permissions.

Use the available data rather than relying on a fixed tab arrangement. The investigation principles remain consistent: establish identity with Image, measure resources with Performance views, inspect execution with Threads, connect network observations with TCP/IP, and evaluate context with Security, Environment, runtime, and service information.

Key Terms

• Process owner: The user account under which a process runs.
• Parent process: The process that launched or is associated with creating another process.
• Thread: An execution unit within a process.
• TCP/IP endpoint: A local or remote network address and port associated with communication.
• Security token: A Windows security context containing identity, group, privilege, and integrity information.
• Environment variable: A named value that can influence application behavior.
• String: Readable text found in an executable or process memory that may provide investigative clues.
• .NET assembly: A managed code component loaded by a .NET application.

For the focused procedure, see Process Properties.