The Main Window

Views

The Process Explorer window shows by default two panes: the upper pane is always a process list and the bottom either shows the list of DLLs loaded into the process selected in the upper pane, or the list of operating system resource handles (files, Registry keys, synchronization objects) the process has open; the view mode determines which information is shown in the bottom pane. To switch the view, use the View|Lower Pane View menu item, the corresponding toolbar button (which toggles), or the Ctrl+D (DLL view) and Ctrl-H (handle view) accelerator keys.

If you are only interested in seeing the processes running on your system You can hide the lower pane by selecting View|Hide Lower Pane, the corresponding toolbar button, the Ctrl+L accelerator, or by dragging the pane divider to the bottom of the Process Explorer window. You can bring back the lower pane by selecting View|Show Lower Pane, typing Ctrl+L or selecting the toolbar button again.

Mini Graphs

Process Explorer includes a toolbar and mini graphs for CPU, memory, and if on Windows 2000 or higher, I/O history, at the top of the main window. They can be resized with respect to one another or dragged such that each is on a separate row. The mini-graphs show history of system activity and hovering the mouse over a point on a graph displays in a tooltip the associated time and the process information for point in time. For example, the tooltip for the mini-CPU graph shows the process that was the largest consumer of CPU. Clicking on any of the mini-graphs opens the System Information dialog.

Refresh Rate and Difference Highlighting

Configure the rate at which Process Explorer refreshes its window by using the View|Update Speed menu item. You can refresh the view manually at any time with View|Refresh, the refresh toolbar button, or by pressing F5. Some checks, such as whether a process is part of a Job object or uses the .NET runtime, only occur during process startup. Press F5 to have Process Explorer recheck the status of all processes.

Process Explorer uses difference highlighting to help you see what items change between refreshes. Items, including processes, DLLs, and handles, that exit or are closed show in red and new items show in green. If the refresh rate is not paused the highlighting remains in effect for the interval specified by the Options|Difference Highlight Duration dialog, which has a default value of 1 second. If you pause the display the difference highlighting is in effect only until the next time you manually refresh.

Opacity

You can make the Process Explorer window partially transparent so that windows beneath it show through on systems that support it by making a selection under the View|Opacity menu item.

Saving

When you choose File|Save Process Explorer saves the contents of the Process and lower pane, if it is showing, as a tab-delimited text file.

Shutting Down or Logging Off
Use the File|Shutdown menu items to shutdown, reboot, lock or logoff the system. When available, the menu also offers options for hibernating and suspending the system.

Run
Use this option to run other applications from Process Explorer using the standard Windows Run dialog.

Runas
This variant on the Run command allows you to enter alternate credentials for the launching application. Process Explorer leverages the same Windows functionality as the Runas Windows command to provide this support. The Runas menu item is not present on Windows 9x.

Run as Limited User
This variant on the Run command runs the application you specify in the same account as that of Process Explorer, but without administrative privileges or membership in the local administrators group. This option restricts the exposure of your system from applications, such as Internet Explorer, that might be compromised through access of untrusted data.