Save a List of Running Processes to a Text File in Windows

Sometimes, it can seem like there are so many processes running on your computer that you’re unsure which are okay and which might be suspicious or malicious.

A good first step is generating a list of running processes to a text file so you can analyze what processes are running. Usually, people use Task Manager to view all processes, but it doesn’t let you print the list of processes.

Thankfully, saving a list of running processes to a text file in Windows is very simple. You’ll be able to save both the Process ID (PID) and how much memory each process is using.

Note: The steps below to save processes to file work for all versions of Windows including Windows XP, Windows 7, Windows 8, and Windows 10.

Output Processes From The Tasklist Command

The easiest way to get a quick list of processes that are running on your Windows system is using the tasklist command. To run the command properly, you need to run it from the command prompt as an administrator.

To do this, select the start menu and type “command”, then hover the mouse over Command Prompt so it’s highlighted and then select Run as administrator on the right.

Note: You may need to select Yes on a pop-up window to approve running Command Prompt as administrator.

Once the command prompt is open, type tasklist and press enter to see a list of processes running on your system.

This is useful, but it doesn’t provide you the list of running processes in a text file. To save processes to file, repeat the process above, but this time type the command:

tasklist > c:\process_list.txt

This will output a text file named process_list.txt to your C: drive. You can change C:\ to any other path where you’d like to place the file if you want.

To view the file, just open Windows Explorer and browse to the location where you saved the process list file.

To view this process list in Notepad, right-click the file, select Open with, and select Notepad.

This is the quickest and easiest way to see running processes in Windows via a text file. It’ll show you PID, Session name, Session number, and memory usage.

Save Processes To File Using Powershell

Another tool you have available to save a list of running processes to a text file in Windows is Powershell. 

Powershell includes a command called “get-process” that provides a list of all active processes that are running on your local computer.  To see this in action, launch Powershell by selecting the Start menu and typing Powershell. 

Once the blue Powershell window opens, type get-process and press Enter. This will display a list of all active processes on your Windows system.

This provides a little more information about processes than tasklist does. However, you need to know what the headers mean.

• Handles: Number of handles that the process has opened
• NPM(K): Non-paged memory the process is using (in kilobytes)
• PM(K): Pageable memory the process is using (in kilobytes)
• WS(K): Pages in memory recently used by the process (in kilobytes)
• VM(M): Virtual memory used by the process (in megabytes)
• CPU(s): Processor time used by the process across all processors (in seconds)
• ID: Process ID of the process
• ProcessName: Name of the process

This is great, but all of this information is displayed on the screen and not to a file. To output this information to a file, you need to add the Out-File parameter to the Get-Process command.

Back in the Powershell screen, type the command Get-Process | Out-File -FilePath .\Process_list.txt and press Enter.

The .\Process_list.txt parameter puts the file in the path where you run the command, so make note of that path so you know where to find the process list file. After you’ve run the command, use the same process as above to open the process list file in Notepad. 

You’ll notice that the data in the file looks identical to the Get-Process output in the previous Powershell window.

Save Processes To File Using WMIC

The last tool you have at your disposal in Windows is the Windows Command Line Utility (WMIC). 

You can only use WMIC commands if you are running the command prompt as a local administrator. To do this, use the steps in the first section of this article to launch the Windows command prompt as an administrator.

WMIC provides you with more information about active processes than any other command or tool in Windows. If you just run the WMIC Process command in the command prompt, you’ll see up to 44 process parameters returned for every active process.

The problem with running the command in the command prompt is that the space delimited output looks jumbled and disorganized.

The WMIC command is a perfect example of when an output file is useful. You can output the WMIC process list to a file using the command: wmic /OUTPUT:C:\ProcessList.txt PROCESS get /all. 

This will output the entire list to a text file on the C: drive called ProcessList.txt. Instead of opening this file in Notepad, you’ll want to open it using Excel since Excel can properly format a tab delimited file.

1. Open Excel
2. Select Open to open a new file
3. Select Browse and browse to the ProcessList.txt file
4. Select the file and select Open (if you don’t see the file, change file type to All Files)
5. In the Text Import Window, select Delimited, select My data has headers, and select Next to continue

6. In the next wizard screen, select the Space checkbox under the Delimiters section and select the Treat consecutive delimiters as one checkbox. Select Next to continue.

7. Select Finish to complete the wizard.

Now you’ll see just about anything you could possibly want to know about every active process on your Windows system.

The header of each column describes what that data item is. You’ll find things like executable path, handle, install date, page faults, page file usage, process ID, and much more. 

Now that you know multiple ways to save a list of running processes to a text file in Windows, all you have left to do is choose the one that’s right for you!

Do you know of any other ways to save processes to file? Share your thoughts in the comments section below.