Find Process Name by its Process ID

Question

Suppose I know the process ID. I want to find the process name by its ID, using windows batch script. How can I do this?

score 124 · Accepted Answer · edited Apr 16 '17 at 07:52

The basic one, ask tasklist to filter its output and only show the indicated process id information

tasklist /fi "pid eq 4444"

To only get the process name, the line must be splitted

for /f "delims=," %%a in ('
    tasklist /fi "pid eq 4444" /nh /fo:csv
') do echo %%~a

In this case, the list of processes is retrieved without headers (/nh) in csv format (/fo:csv). The commas are used as token delimiters and the first token in the line is the image name

note: In some windows versions (one of them, my case, is the spanish windows xp version), the pid filter in the tasklist does not work. In this case, the filter over the list of processes must be done out of the command

for /f "delims=," %%a in ('
    tasklist /fo:csv /nh ^| findstr /b /r /c:"[^,]*,\"4444\","
') do echo %%~a

This will generate the task list and filter it searching for the process id in the second column of the csv output.

edited: alternatively, you can suppose what has been made by the team that translated the OS to spanish. I don't know what can happen in other locales.

tasklist /fi "idp eq 4444"

Is there a way to get all the processes and PIDs alone??? We can do it in linux but not sure about dos commands. Please help. — arunpandiyarajhen, Jul 03 '18 at 15:07
for me it is showing that "tasklist: command not found" what should i do? — Rohan Devaki, Mar 16 '21 at 17:29

Craig Tullis · Answer 2 · 2016-09-29T23:18:51.063

7

Using only "native" Windows utilities, try the following, where "516" is the process ID that you want the image name for:

for /f "delims=," %a in ( 'tasklist /fi "PID eq 516" /nh /fo:csv' ) do ( echo %~a )
for /f %a in ( 'tasklist /fi "PID eq 516" ^| findstr "516"' ) do ( echo %a )

Or you could use wmic (the Windows Management Instrumentation Command-line tool) and get the full path to the executable:

wmic process where processId=516 get name
wmic process where processId=516 get ExecutablePath

Or you could download Microsoft PsTools, or specifically download just the pslist utility, and use PsList:

for /f %a in ( 'pslist 516 ^| findstr "516"' ) do ( echo %a )

edited Sep 29 '16 at 23:18

answered Nov 30 '14 at 08:40

Craig Tullis

9,939
2
21
21

If the process ID is less than 1000, the `find` command can retrieve the wrong lines matching the data in the memory column in the case of `tasklist`, or (lower or greater than 1000) in any of the numeric columns in the `wmic` or `pslist` numeric columns. – MC ND Nov 30 '14 at 10:14
Adding a tailing space does not solve the problem (ex: `1.500` in memory column). In tasklist you can filter the output (`/fi`), in wmic you can filter the output (`where` clause), in pslist you can filter the output (give the `pid` in command line). While `grep` is a great tool, there is no need to use it here – MC ND Nov 30 '14 at 10:24
1

Alright, good call. Making me work for it... ;-) – Craig Tullis Nov 30 '14 at 10:29

score 2 · Answer 3 · answered Nov 30 '14 at 08:51

@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SET /a pid=1600
FOR /f "skip=3delims=" %%a IN ('tasklist') DO (
 SET "found=%%a"
 SET /a foundpid=!found:~26,8!
 IF %pid%==!foundpid! echo found %pid%=!found:~0,24%!
)

GOTO :EOF

...set PID to suit your circumstance.

Find Process Name by its Process ID

3 Answers3

Linked