Process Explorer can show currently running processes and also can show the command line each process was started with. Is there a tool that can capture a trace of processes that were started and finished while the tool is running with the respective command lines?


Process Monitor, also from SysInternals can do that:


By default, the command line isn't shown, but if you right-click on the column headers and click on "Select Columns", you can add "Command Line" to the list of displayed columns.

Edit: If you haven't ever used Process Monitor before, it generates a lot of information. But, if you're looking for a particular *.exe or something, you can specify various filters so that you only get what you're looking for.

For example, if you wanted to just show the information for any cmd.exe processes, you can click on the filter button (Ctrl-L), and add a filter like this:

enter image description here

This is what needs to be selected to filter out process start / process exit operations you are after:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.