有时，您的计算机上似乎运行着太多进程，以至于您不确定哪些是正常的，哪些可能是可疑或恶意的。
一个好的第一步是生成一个正在运行的进程列表到一个文本文件，这样您就可以分析哪些进程正在运行。通常，人们使用任务管理器(Task Manager)来查看所有进程，但它不允许您打印进程列表。
值得庆幸的是，将正在运行的进程列表保存到Windows中的文本文件非常简单。您将能够保存进程 ID(Process ID) ( PID ) 和每个进程使用的内存量。
注意(Note)：以下将进程保存到文件的步骤适用于所有 Windows 版本，包括(Windows)Windows XP(Windows XP)、Windows 7、Windows 8 和Windows 10。
从任务列表命令(Tasklist Command)输出进程
获取Windows(Windows)系统上正在运行的进程的快速列表的最简单方法是使用 tasklist 命令。要正确运行该命令，您需要以管理员身份从命令提示符运行它。
为此，请选择开始菜单并键入“命令”，然后将鼠标悬停在命令提示符(Command Prompt)上使其突出显示，然后选择右侧的以管理员身份运行。(Run as administrator)
注意：您可能需要在弹出窗口中选择Yes以批准(Yes)以管理员身份运行命令提示符(running Command Prompt as administrator)。
打开命令提示符后，键入tasklist并按 enter 以查看系统上运行的进程列表。
这很有用，但它不会在文本文件中为您提供正在运行的进程列表。要将进程保存到文件，请重复上述过程，但这次键入命令：
tasklist > c:\process_list.txt
这会将名为 process_list.txt 的文本文件输出到您的 C: 驱动器。如果需要，您可以将 C: 更改为您想要放置文件的任何其他路径。
要查看该文件，只需打开 Windows 资源管理器(open Windows Explorer)并浏览到您保存进程列表文件的位置。
要在记事本(Notepad)中查看此进程列表，请右键单击该文件，选择打开方式(Open with)，然后选择记事本(Notepad)。
这是通过文本文件查看Windows中正在运行的进程的最快捷、最简单的方法。它会显示PID、会话(Session)名称、会话(Session)编号和内存使用情况(memory usage)。
(Save Processes To File)使用 Powershell将进程保存到文件
另一个可用于将正在运行的进程列表保存到Windows中的文本文件的工具是Powershell。
Powershell包含一个名为“get-process”的命令，它提供了在本地计算机上运行的所有活动进程的列表。要查看此操作，请通过选择“开始(Start)”菜单并键入Powershell来启动(Powershell)Powershell。
打开蓝色Powershell窗口后，键入get-process并按Enter。这将显示Windows系统上所有活动进程的列表。
这比 tasklist 提供了更多关于进程的信息。但是，您需要知道标题的含义。
- Handles : 进程已打开的句柄数
- NPM(K)：进程正在使用的非分页内存（以千字节为单位）
- PM(K)：进程正在使用的可分页内存（以千字节为单位）
- WS(K)：进程最近使用的内存中的页面（以千字节为单位）
- VM(M)：进程使用的虚拟内存（以兆字节为单位）
- CPU(s)：进程在所有处理器上使用的处理器时间（以秒为单位）
- ID : 进程的进程 ID
- ProcessName : 进程的名称
这很好，但所有这些信息都显示在屏幕上，而不是文件中。要将此信息输出到文件，您需要将 Out-File 参数添加到Get-Process命令。
返回Powershell屏幕，键入命令Get-Process | Out-File -FilePath .\Process_list.txt并按 Enter。
.\Process_list.txt参数将文件放在运行命令的路径中，因此请记下该路径，以便知道在哪里可以找到进程列表文件。运行命令后，使用与上述相同的进程在记事本(Notepad)中打开进程列表文件。
您会注意到文件中的数据看起来与上一个Powershell窗口中的Get-Process输出相同。
(Save)使用 WMIC 将进程保存到文件
在Windows(Windows)中您可以使用的最后一个工具是Windows 命令行实用程序(Windows Command Line Utility)( WMIC )。
如果您以本地管理员身份运行命令提示符，则只能使用WMIC命令。(WMIC)为此，请使用本文第一部分中的步骤以管理员身份启动Windows命令提示符。(Windows)
(WMIC)与Windows中的任何其他命令或工具相比， (Windows)WMIC为您提供了有关活动进程的更多信息。如果您只是在命令提示符下运行WMIC Process命令，您将看到为每个活动进程返回多达 44 个进程参数。
在命令提示符下运行命令的问题在于，以空格分隔的输出看起来杂乱无章。
WMIC命令是输出文件何时有用的完美示例。您可以使用以下命令将WMIC进程列表输出到文件：wmic /OUTPUT:C:\ProcessList.txt PROCESS get /all。
这会将整个列表输出到 C: 驱动器上名为ProcessList.txt的文本文件中。而不是在记事本(Notepad)中打开此文件，您需要使用 Excel(using Excel)打开它，因为Excel可以正确格式化制表符分隔的文件。
- 打开 Excel
- 选择打开(Open)以打开一个新文件
- 选择浏览(Browse)并浏览到ProcessList.txt文件
- 选择文件并选择打开(Open)（如果看不到文件，请将文件类型更改为All Files）
- 在 Text Import Window 中，选择Delimited，选择My data has headers，然后选择Next继续
- 在下一个向导屏幕中，选中分隔符(Delimiters)部分下的空格(Space)复选框，然后选中将连续分隔符视为一个(Treat consecutive delimiters as one)复选框。选择下一步(Next)继续。
- 选择完成(Finish)以完成向导。
现在，您将看到有关Windows系统上每个活动进程的任何信息。
每列的标题描述了该数据项是什么。您会发现可执行路径、句柄、安装日期、页面错误、页面文件使用情况、进程 ID 等等。
既然您知道了多种将正在运行的进程列表保存到Windows中的文本文件的方法，那么您剩下要做的就是选择适合您的方法！
您知道将进程保存到文件的任何其他方法吗？在下面的评论部分分享(Share)您的想法。
Save a List of Running Processes to a Text File in Windows
Sоmetimes, it сan seem like there are so manу processes rυnnіng on yoυr computer that you’re unsure whіch are okay and which might be suspіciouѕ or malicіous.
A good first step is generating a list of running processes to a text file so you can analyze what processes are running. Usually, people use Task Manager to view all processes, but it doesn’t let you print the list of processes.
Thankfully, saving a list of running processes to a text file in Windows is very simple. You’ll be able to save both the Process ID (PID) and how much memory each process is using.
Note: The steps below to save processes to file work for all versions of Windows including Windows XP, Windows 7, Windows 8, and Windows 10.
Output Processes From The Tasklist Command
The easiest way to get a quick list of processes that are running on your Windows system is using the tasklist command. To run the command properly, you need to run it from the command prompt as an administrator.
To do this, select the start menu and type “command”, then hover the mouse over Command Prompt so it’s highlighted and then select Run as administrator on the right.
Note: You may need to select Yes on a pop-up window to approve running Command Prompt as administrator.
Once the command prompt is open, type tasklist and press enter to see a list of processes running on your system.
This is useful, but it doesn’t provide you the list of running processes in a text file. To save processes to file, repeat the process above, but this time type the command:
tasklist > c:\process_list.txt
This will output a text file named process_list.txt to your C: drive. You can change C:\ to any other path where you’d like to place the file if you want.
To view the file, just open Windows Explorer and browse to the location where you saved the process list file.
To view this process list in Notepad, right-click the file, select Open with, and select Notepad.
This is the quickest and easiest way to see running processes in Windows via a text file. It’ll show you PID, Session name, Session number, and memory usage.
Save Processes To File Using Powershell
Another tool you have available to save a list of running processes to a text file in Windows is Powershell.
Powershell includes a command called “get-process” that provides a list of all active processes that are running on your local computer. To see this in action, launch Powershell by selecting the Start menu and typing Powershell.
Once the blue Powershell window opens, type get-process and press Enter. This will display a list of all active processes on your Windows system.
This provides a little more information about processes than tasklist does. However, you need to know what the headers mean.
- Handles: Number of handles that the process has opened
- NPM(K): Non-paged memory the process is using (in kilobytes)
- PM(K): Pageable memory the process is using (in kilobytes)
- WS(K): Pages in memory recently used by the process (in kilobytes)
- VM(M): Virtual memory used by the process (in megabytes)
- CPU(s): Processor time used by the process across all processors (in seconds)
- ID: Process ID of the process
- ProcessName: Name of the process
This is great, but all of this information is displayed on the screen and not to a file. To output this information to a file, you need to add the Out-File parameter to the Get-Process command.
Back in the Powershell screen, type the command Get-Process | Out-File -FilePath .\Process_list.txt and press Enter.
The .\Process_list.txt parameter puts the file in the path where you run the command, so make note of that path so you know where to find the process list file. After you’ve run the command, use the same process as above to open the process list file in Notepad.
You’ll notice that the data in the file looks identical to the Get-Process output in the previous Powershell window.
Save Processes To File Using WMIC
The last tool you have at your disposal in Windows is the Windows Command Line Utility (WMIC).
You can only use WMIC commands if you are running the command prompt as a local administrator. To do this, use the steps in the first section of this article to launch the Windows command prompt as an administrator.
WMIC provides you with more information about active processes than any other command or tool in Windows. If you just run the WMIC Process command in the command prompt, you’ll see up to 44 process parameters returned for every active process.
The problem with running the command in the command prompt is that the space delimited output looks jumbled and disorganized.
The WMIC command is a perfect example of when an output file is useful. You can output the WMIC process list to a file using the command: wmic /OUTPUT:C:\ProcessList.txt PROCESS get /all.
This will output the entire list to a text file on the C: drive called ProcessList.txt. Instead of opening this file in Notepad, you’ll want to open it using Excel since Excel can properly format a tab delimited file.
- Open Excel
- Select Open to open a new file
- Select Browse and browse to the ProcessList.txt file
- Select the file and select Open (if you don’t see the file, change file type to All Files)
- In the Text Import Window, select Delimited, select My data has headers, and select Next to continue
- In the next wizard screen, select the Space checkbox under the Delimiters section and select the Treat consecutive delimiters as one checkbox. Select Next to continue.
- Select Finish to complete the wizard.
Now you’ll see just about anything you could possibly want to know about every active process on your Windows system.
The header of each column describes what that data item is. You’ll find things like executable path, handle, install date, page faults, page file usage, process ID, and much more.
Now that you know multiple ways to save a list of running processes to a text file in Windows, all you have left to do is choose the one that’s right for you!
Do you know of any other ways to save processes to file? Share your thoughts in the comments section below.
