TLIST.exe (Windows Driver Kit WDK)

Task List. Show the command line, current working directory (CWD), memory usage and DLLs for each running task.

TLIST was included in the Windows NT 4 Resource Kit & Windows 2000 Support Tools, but currently this command is only available as part of the WDK, a 16 GB download.

Syntax
      TLIST {/p ProcessName | PID | Pattern } options

Key
   /p ProcessName
       Display the process identifier (PID) of the specified process.
       ProcessName is the name of the process (with or without file name extension), not a pattern.
       If the value of ProcessName does not match any running process, TList displays -1.
       If it matches more than one process name, TList displays only the PID of the first matching process.

   PID Display detailed information about the process specified by PID.
       For information about the display, see the "Remarks" section below.
       To find a process ID, type tlist without any additional parameter.

   Pattern
       Display detailed information about all processes whose names or window titles match the
       specified pattern.(e.g. CMD.*) Pattern can be a complete name or a regular expression.
   
   /c  Display the command line that started each process.
   
   /e  Display the session identifier for each process.
       Valid session identifiers appear in the process list only under the following conditions.
       Otherwise, the session identifier is zero (0).
          - On Windows XP, Fast User Switching must be enabled and more than one user must be connected
          to the non-console session.
          - On Windows Vista, where all processes are associated with two Terminal Services sessions by
          default, at least one user must be connected to the non-console session.

   /k  Display the COM components active in each process.
   
   /m Module
       List tasks in which the specified DLL or executable module is loaded.
       Module can be a complete module name or a module name pattern.
   
   /s  Display the services that are active in each process

   /t  Display a task tree in which each process appears as a child of the process that created it.

   /v  Display details of running processes including the process ID, session ID, window title,
       command line, and the services running in the process.

TLIST was ostensibly replaced by TASKLIST, however TLIST has the advantage of showing the full path of the process and its current working directory.

In its detailed display of a process (tlist PID or tlist Pattern), TList displays the following information:

• Process ID, executable name, friendly name of the program.
• Current working directory (CWD).
• The command line that started the process (CmdLine).
• Current virtual address space values.
• Number of threads.
• A list of threads running in the process. For each thread, TList displays the thread ID (TID), the function that the thread is running, the address of the entry point, the address of the last reported error (if any), and the thread state.
• A list of the modules loaded for the process. For each module, TList displays the version number, attributes, virtual address of the module, and the module name.

Examples

Batch file to show the full path of all running programs:

@ECHO off
FOR /f "tokens=1" %%G in ('tlist') DO (call :s_item %%G)
GOTO :eof

:s_item
tlist %1 | find "CmdLine"

Display the full path of a process in PowerShell:

Get-process -id 11832 | Select name, path

Name    Path
----    ----
notepad C:\Windows\system32\notepad.exe

“When I first started running, I was so embarrassed, I'd walk when cars passed me. I'd pretend I was looking at the flowers” ~ Joan Benoit Samuelson, 1984 Olympic Marathon gold medalist

Related commands

PsList - List detailed information about processes.
TLIST - Microsoft help page.
TASKLIST - List running applications and services.
MSINFO32 - Windows diagnostics.
Equivalent PowerShell: Get-Process - Get a list of processes on a machine (ps/gps).
Equivalent bash command (Linux): ps - Process status, information about processes running in memory.