sticky
** Feature Requests **

All replies

  • I would like to add some ideas to the feature list:

    -Multiple process suspend/resume or kills
    -DLL ejection
    -Thread suspend/resume on 9x (I have seen this done with another task manager btw)
    - Handle / DLL filter box

    I also think we should have a bug list thread and make both pinned topics.

    Richard S.
    Saturday, August 5, 2006 3:09 AM
  • Hi, redhawk.

    I guess you misunderstood me.

    This thread was only meant to be an overview of threads that hold feature requests so they can be found easily.

    This is why I asked,
    Feel free, though, to add links to other P.E. feature requests which are not listed, yet.


    If we start posting feature requests directly in this thread, I assume it will soon turn into an unreadable endless monster.

    Yet, this is just my personal idea.

    Apart from this, I agree that it might be helpful to have sticky threads for bug reports as well.

    The problems with sticky threads for feature requests and bug reports are
    • Due to a bug in the forum stoftware, any sticky thread will loose its sticky property as soon as a normal user adds a message. Only moderators can assign the sticky property again thus moving it back to the top of the thread list.

    • Those 2 sticky threads should exist for each Sysinternals utility, so there would be quite a number of these sticky threads.

    • Someone would have to make sure double feature requests are somehow joined.

    • Someone would have to evaluate the bug reports and take out those that are actually handling errors.

    • Forum software products do not offer a really professional approach to keeping track of feature requests and bugs. Doing it manually for all Sysinternals utilities might easily be a fulltime job, but none of the moderators works fulltime for this forum, we are all doing it in our spare time.


    Hm, so after all maybe creating this sticky thread was not such a good idea.

    Karl
    Saturday, August 5, 2006 10:09 PM
  • Another feature request: For the ability to save the column settings to a file

    http://forum.sysinternals.com/forum_posts.asp?TID=7448&P N=1&TPN=1

    Tuesday, August 15, 2006 4:12 AM
  • Thanks. Added it to the first post in this thread.

    Karl
    Tuesday, August 15, 2006 6:29 AM
  • Thanks, Kyle.

    The feature request is already in the list in the first message:
    RFE: Type >1 char selects better matches.
    Compare to the thread you point us to: Keyboard selection annoyance in v10, please.
    Different words, same complaint about lost feature, same request to re-introduce it.

    Karl
    Friday, August 18, 2006 8:51 PM
  • Thanks for adding my previous request. Could you also add this one please.
    http://forum.sysinternals.com/forum_posts.asp?TID=7662&PN=1& TPN=1

    Ability to see the peak CPU level that the process has reached.
    Monday, August 28, 2006 1:22 AM
  • I could not "see" process explorer on my desktop, although it was running in the system tray.  When I right-clicked and selected MOVE, I was able to move the crosshair with my arrow keys and then hit enter (this is supposed to work on any application in Windows that has jumped off the desktop).  However, Process Explorer still did not appear on the crosshairs like it was supposed to.
     
    To complicate the problem, I could not get my task manager back because when Process Explorer was working correctly, I had checked the box to replace my task manager.  Note: I would suggest in the future update that you add Options to the right-click menu on the system tray icon.  I will post a copy of this suggestion in the appropriate thread too.
     
    SOLUTION:  To get my original task manager back, I had to go to START::RUN and type in REGEDIT.  I did a search for procexp.exe and then deleted every instance (about 10 I think).  Now I got back my task manager!
    Sunday, September 10, 2006 5:39 AM
  • Hello, I'm from Argentina, and I use to use process explorer, but the file size of the program... become to be biggest.. I think that these type of programs would be small.

    Thank's.

    Wednesday, September 27, 2006 2:30 PM
  • Feature request for Process Explorer to identify "protected processes" in Vista; thread is at:
     
    Thursday, October 5, 2006 9:09 AM
  • Can the following request be added to the list please:

    http://forum.sysinternals.com/forum_posts.asp?TID=8401&P N=1&TPN=1

    Request for computer name to be included in window title and system tray tool tip.

    Thanks,

    Mark

    Sunday, October 15, 2006 9:21 PM
  • Hi, molotov. Hi, robbinma.

    Added your requests to the list in the starting message.

    Karl
    Monday, October 16, 2006 7:35 AM
  • Hi!

    Dunno if it's already officially requested.
    How about localizations?
    Something like external textfiles with additional languages.
    Monday, October 16, 2006 4:37 PM
  • Feature request:

    If the lower pane is disabled, don't try to load any handle or DLL information upon starting up. This would allow Process Explorer to run even when system handles have grown to excessive numbers due to a handle leak. Maybe there could also be a checkmark under Options to disable all handle processing. This would make process explorer a lot more stable in the event of a system handle leak.

    Tuesday, October 17, 2006 6:12 AM
  • Please add the "Process Startup Log" feature to your list.

    http://forum.sysinternals.com/forum_posts.asp?TID=8417

    Thanks,

    Dimitris Staikos

    Tuesday, October 17, 2006 5:45 PM
  • Hi, Dimitris.

    If I am not mistaken your request Process Startup History feature? and this request Feature Request: PE Logging look pretty similar to me.

    And this request Feature Request: PE Logging is in the list of feature requests.

    So I assume this covers your request, too.

    Karl
    Sunday, October 22, 2006 2:52 AM
  • Hi!
    Dunno if it's already officially requested.
    How about localizations?
    Something like external textfiles with additional languages.


    Cf. this thread, A French Translation?, please.
    Added request to the Feature Request List.

    Karl
    Sunday, October 22, 2006 3:11 AM
  • Hi, Dimitris.

    If I am not mistaken your request Process Startup History feature? and this request Feature Request: PE Logging look pretty similar to me.

    Damn, they look pretty similar to me too :-)


    And this request Feature Request: PE Logging is in the list of feature requests.

    So I assume this covers your request, too.
    Karl

    Indeed it does. Looks like I was not pretty thorough when checking the list. The feature's title is not exactly self-describing ("PE logging" could mean almost anything) so I just thought it would probably be about something else and didn't have a look at it.

    Thanks,

    Dimitris

    Sunday, October 22, 2006 5:40 AM
  • Hi, Dimitris.

    No problem whatsoever. It only shows that the list may not be too well-structured. Else you would have noticed that your wish had been requested before.

    Karl
    Sunday, October 22, 2006 7:47 AM
  • Feature request:
    I would like to enable/disable token privileges using Process Explorer.
    Sunday, October 29, 2006 5:51 AM
  • Feature request for Process Explorer to identify the version of the .NET Framework that a ".NET Process" has loaded into its address space; thread is at:
     
    Sunday, October 29, 2006 8:35 AM
  • Keyboard shortcut for suspend/resume, maybe Pause/Break or CTRL+P. Should of course only be available when navigating PE's listview.

    Would be nice when only using the keyboard.

    Saturday, November 4, 2006 12:20 AM
  • Anything wrong with using the same keyboard shortcuts while in process tree mode?

    Karl
    Saturday, November 4, 2006 6:29 AM
  • I would like to close PE when I click on Close (X) and minimize to tray when click on Minimize (_)!!!

    Sorry on bad english.
    Saturday, December 30, 2006 10:27 PM
  • Bring back the ability to choose which search engine to use!! Until then I will have to keep using version 10.2! 
    Wednesday, January 3, 2007 7:40 AM
  • I'd like to request that ProcExp remember the locations and sizes of it's dialog boxes.  System Information, Properties, pretty much all boxes that are re-sizable, or display constantly updating information, specifically any modal boxes.

    Thanks a lot.

    Friday, January 12, 2007 3:03 PM
  • It would be good to be able to inspect drivers loaded in memory...
    Tuesday, January 30, 2007 7:11 AM
  • @Igort75 -
    To view the list of drivers, select the "system" "process" and enable the lower-pane view's DLL mode (ctrl-d).
    Tuesday, January 30, 2007 7:34 AM
  • Bring back the ability to choose which search engine to use!! Until then I will have to keep using version 10.2! 

    Thank you for the tip about the most recent version containing this feature! I was dismayed when Process Explorer itself revealed the string http://search.msn.com hard coded into its own executable.

    BTW what are the other differences between 10.2 and 10.21?

    Thanks,

    Tuesday, February 20, 2007 3:19 AM
  • what are the other differences between 10.2 and 10.21?

    From the site blog:

    Process Explorer v10.21

    This Process Explorer release fixes a bug in 32-bit path resolution on 64-bit systems and changes the threads tab to asynchronously populate its thread list.

    Tuesday, February 20, 2007 3:33 AM
  • Bring back the ability to choose which search engine to use!! Until then I will have to keep using version 10.2!
    Thank you for the tip about the most recent version containing this feature! I was dismayed when Process Explorer itself revealed the string http://search.msn.com hard coded into its own executable.

    Not likely to happen.  Microsoft is steadfast in it's refusal to accommodate competing technologies, and now that it owns Sysinternals, you'll see this with it's new toys.

    Tuesday, February 20, 2007 3:39 AM
  • Didn't I read somewhere that future utilities / releases would respect the Search Provider configured in IE7, if IE7 is found on the system?
     
    Theoretically , one could also use a hex editor on procexp.exe...
    Tuesday, February 20, 2007 8:00 AM
  • Is that any and all utilities from MS, or just IE related ones?

    I doubt for example that Office or VS.NET or SQL Server, etc would care.

    Tuesday, February 20, 2007 9:39 AM
  • Err... Sorry, I meant Sysinternals stuff, not other MS stuff.
    Tuesday, February 20, 2007 10:36 AM
  • Ah ok.  In fact I recall reading something about leaving things relatively unchanged, although I may be thinking of one of many other acquisitions.

    Tuesday, February 20, 2007 1:07 PM
  • Another feature request would be 'Logging Performance Data', see 

    http://forum.sysinternals.com/forum_posts.asp?TID=6828

    Monday, March 5, 2007 11:05 PM
  • Monday, March 5, 2007 11:45 PM
  • Diddn't I read somewhere that future utilities / releases would respect the Search Provider configured in IE7, if IE7 is found on the system?
     
    Found what I was thinking of...
    Autoruns ... uses the configured IE7 search engine for on-line searches ...
     
    While this isn't a comment on all Sysinternals tools, it does show that attention is being paid to the choice of search engines that the tools allow one to use.  I guess I would be surprised if Process Explorer didn't adopt this technique with the next version...
    Tuesday, March 6, 2007 7:00 AM
  • AutoKill:

    http://forum.sysinternals.com/forum_posts.asp?TID=10683&PID=47311#47311
    Saturday, May 5, 2007 1:37 AM
  • How about a workaround for SecuROM's idiocy (ie refusing to run when PE has been loaded previously)?
    Wednesday, June 13, 2007 4:35 PM

  • How about a workaround for SecuROM's idiocy (ie refusing to run when PE has been loaded previously)?


    I don�t think that it detects PE explicitly, what it does it to detect certain things like hooks and such, and considers those to be part of a debugger like some games (eg Popcap�s) do. There�s probably a way around it, just like there is a way around SoftIce detection, but it goes beyond a utility and turns into an outright hacking app (technically speaking since it circumvents copy protection and/or uses �hacking� techniques�which are now illegal in Germany and others.)
    Friday, June 15, 2007 8:09 AM
    • Various PE Feature Requests by Matts_User_Name.
      (Well, as the title indicates this is not just 1 feature request, but a rich list of requests and richly illustrated.) 
      -- 
      Karl

    Monday, June 18, 2007 5:59 AM
    • Various PE Feature Requests by Matts_User_Name.
      (Well, as the title indicates this is not just 1 feature request, but a rich list of requests and richly illustrated.) 
      -- 
      Karl
    Thanks karl =]
    Monday, June 18, 2007 11:55 PM
  • Multiple CPU graphs in Process Properties dialog
    http://forum.sysinternals.com/forum_posts.asp?TID=11151
    Tuesday, June 19, 2007 10:53 PM
  • FEATURE: control service by rightclick: start/stop/make manual/disable/delete etc

     
    FEATURE: API or scripting language, for example i often have to kill a mutex that is used to make an app single-instance.
    Tuesday, July 17, 2007 4:29 AM
  • Thursday, September 6, 2007 7:04 PM
  • (reposted from another thread, in relation to digital signature verification on processes and dlls)

    Why don't sysinternals programs distinguish between:
    1. Signed (and Verified)
    2. Signed (but file doesn't match Signature)
    3. Not Signed
    4. Unknown (because the sysinternals program gave up trying to retrieve the necessary certificates after 5 seconds)


    Currently they are displayed like this:

    1. Verified
    2. Unable to verify
    3. Unable to verify
    4. Unable to verify


    2 and 3 should be distinguished between, and 4 shouldn't happen except in rare cases. As it is now 4 happens frequently because programs like process explorer try to verify all the items in the list asynchronously and this lags the program (especially in computer with little ram) and causes some that should be 1s to end up as 4s. Also the ability to cache certificates (in a user specified folder) would be handy for offline use.
    Friday, September 7, 2007 5:19 AM
  • Grrr the new PE version is here and he hardly addressed any fixes posted here =[
    Sunday, September 9, 2007 9:55 AM
  • Various feature requests by x-faktor:
    Monday, September 17, 2007 8:07 AM
  • FR: add window class column

    I have MS natural keyboard and it would be usefull for me to know windows classes.
    Thursday, September 27, 2007 7:14 AM
  • Hi holyboy,
     
    I understand your request (I think), but I don't see how "I have MS natural keyboard" pertains to it...  Perhaps you can clarify its relevance?
    Thursday, September 27, 2007 10:23 AM
  • I have a request to quickly be able to open ProcMon from the context menu of ProcExp, with filters set to only displaye the monitored process.

    See Open ProcMon from Process Explorer?

    Thanks
    Bernd
    Thursday, October 4, 2007 6:13 PM
  • Request to display process affinity
     
     
    thanks
    Friday, October 5, 2007 4:43 PM
  • Additional informatin on threads and processes:
     
    requested by:
     
    Saturday, October 13, 2007 1:27 AM
  • Don't know when this feature got added, but anytime there is a new process created, PE will jump to it in the list, scrolling the window. This is good in principle, however I had an HP multi-function printer installed (PSC 2510) that has a horrible printer driver which creates a new process every 30s or so. This means that when I'm looking at an item in PE (let's say sorted by memory used descending), every 30s or so the list scrolls down to this new process (it's at least very small, consuming only a few megs of RAM, but this means it appears in the bottom of the list). So now I need to scroll up again to see what's happening to the process I'm interested in...

    See how this gets annoying very quickly?

    What I'd like therefore, is a way to turn off the "jump to new process" feature. It's very useful in most cases, so I don't think it should be removed, but I do need a way to be able to turn it off when needed. Maybe a new menu option in the View menu?
    Monday, October 29, 2007 2:45 AM
  • Hi HerbCSO,
     
    Are you sure you don't have "Show New Processes" checked in the View menu? Wink
    Monday, October 29, 2007 2:51 AM
  • Well, bugger me, don't I feel stupid now!? I must have looked at that menu trying to find that option a half a dozen times! Sheesh! ;] Sorry, never mind!
    Monday, October 29, 2007 7:44 AM
  • Smile
    It's understandable - the name of the option doesn't necessarily suggest that the view will be scrolled to display the new process.  The help file is a bit clearer, however:
    Show New Processes: when enabled Process Explorer scrolls the Process view to bring into view new processes.
    Monday, October 29, 2007 10:35 AM
  • A PERMANENT SET AFFINITY option for applications. One that doesn't require patching the application. I must have this.
    Monday, November 5, 2007 5:07 PM
  • Well, my favorite utility that I use at my company (Remote Task Manager) seems to have its development suspended.  It has limited use on x64 and very limited use on vista and 2008.
     
    Things it does:
     
    *  Remote task viewing
    *  Remote service viewing
    *  Remote driver viewing
    *  Remote netstat viewing
    *  Remote network usage viewing
    *  Remote shares viewing
    *  Client/Server based task execution (also command line, like psexec, except that the daemon is permanent so its 5-10x faster)
     
    Well, that just stinks, I don't know of ANY other program which does everything RTM does.
     
    While I love process explorer on the local machine, its completely worthless to remote hosts, which is what I'd really want.
     
    Any chance of that happening?  Anyone see anything else like this utility?
     
    agressiv
    Thursday, November 8, 2007 4:04 AM
  • Feature Request: Totals for identical processes...

    On a terminal server especially, it would be great to have a way to sum up metrics such as memory usage for ALL similar processes.  For example, 30 users on a terminal server, 30 instances of Word... how much memory is Word consuming?
     
    Also, it would be great to be able to see totals per user.  So again, on a terminal server to be able to see how much memory/CPU/etc. each user session is consuming.
     
    I know that having these numbers showing "live" add yet more resource usage, so a feature could be set to snapshot, or highlight a bunch of services and right-click to see total figures or something of that nature.
    Thursday, November 8, 2007 8:54 AM
  • Can You include to PE showing hidden processes.
    Sorry for my English
    Wednesday, November 21, 2007 5:30 PM
  • It would be nice if Process Explorer showed Window station / Desktop column in the process view.

    Thursday, December 6, 2007 7:24 PM
  • I would be nice to right click on the "CPU Usage History" in the "System Information" window and export the data to notepad/text file. ( e.g. all the items you get when you mouse over the data ).
    Wednesday, December 12, 2007 1:18 PM

  • Feature Request:

    A separate colum to show on which core(s) a process is currently running.

    I have a Dual Quad-Core machine (= 8 Cores). The only way to see which Core is used by a process is to open the "System Information"-->  "Show on graph per CPU" and look for an graph witch nearly 100% CPU utilisation... but only, if the process has a lot CPU usage...

    Does know anyone a other solution?

    Greetings

    Merleg


    Thursday, January 3, 2008 11:45 PM
  • Feature Request: Multi-CPU options by Adrian
    Sunday, January 13, 2008 1:03 AM
  • Feature Request: Differentiate background tasks by Telcontar
    Friday, January 18, 2008 5:31 AM
  • Feature Requests: Some missings into the PE the great by x-faktor
    Saturday, January 26, 2008 2:20 AM
  • Feature Requests: Process properties / Environment improvement by pouillot
    Sunday, January 27, 2008 7:19 PM
  • I would like to see the following implemented so it would be easier to assess the loads certain processes are using...
     
    add % column (optional) for virtual size (memory)
    and
    add % column (optional) for cpu (cum.) time
     
    where % = percentage of total for the process in that row
     
    for example xxxx is using 3% of the used memory
     
    or
     
    for example xxxx is using 5% of the total cpu time
     
    Why? for example total used cpu time of 0:0:13 is small but knowing that is 1% is more valuable info
     
    And yes I understand these are continuous calculations...if a problem, they could be updated every second or so...or have an optional update setting for the user.
     
    Thanks!
    Monday, January 28, 2008 3:22 AM
  • An easy one:  how about an option to only display the PE icon in the Tray, and not in the Taskbar?  Personally, I like Applications (Firefox, Word, etc.) in the Taskbar; and monitoring programs/drivers/utilities (PE, AV software, Speaker icon, etc.) in the Tray.  For now, I'm using a freeware app called 'Tray It!' to remove the Taskbar bar-icon-name thingee - but that's sloppy.
     
    Other than that one really minor nit-pick, I've liked everything else about PE for the past 2-3 years that I've used it.  It's a great tool for discovering all the junk slowing down my systems!!  There are so many uses for this great tool, perhaps the powers that be will do something crazy - like replace the crippled, barely-useful Taskman with Process Explorer!!!
     
    Farewell.
    Wednesday, January 30, 2008 1:41 PM
  • Hi Scott,
     
    You may be interested to find PE's "Hide When Minimized" feature in the Options menu. Wink
    Wednesday, January 30, 2008 7:12 PM
  • Please "Image type" "64-bit" for 64-bit process and blank field if type cannot be obtained.
    Thursday, January 31, 2008 7:44 AM
  • Howdy!

    Thanks for the reply... yeah, I saw 'Hide when Minimized' - but I don't want to minimize.  I have a dual-monitor system, so I run main apps on the left (center of my desk), and PE (plus other monitors) on the right monitor.  Makes network maintenance a lot easier to be able to know everything going on around here with a glance.  :-)

    Winamp has exactly what I'd LOVE to see in PE, I'll include a pic...



    Cheerio!
    Mr.Scott

    Wacko


    Thursday, January 31, 2008 8:27 AM
  • OK, thanks for the clarification.
    Thursday, January 31, 2008 8:31 AM
  • Fearure Request: Ability to view processes on other network PC's!
     
    open \\PC123X  now that would be useful!!!
     
    *S*
    Monday, February 4, 2008 4:48 AM
  • Feature request: Explorer like way to locate process by typing process name,

    e.g. to locate a process named "abc.exe"

    currently:
    typing "abc" will locate 3 processes, 'a' for the first process whose name starts with 'a', then the first "b*****" process, then the first "c*******" process.

    expected:
    typing "abc" will exactly locate the process "abc.exe", neither "aac******" , nor "aba*******", nor "c****"




    Wednesday, February 6, 2008 12:18 PM
  • Hi creyle,
     
    Sounds a bit like "RFE: Type >1 char selects better matches" referenced earlier in this topic.
    Wednesday, February 6, 2008 12:24 PM
  • Hi molotov,

    Thanks, that's exactly what I want, thanks for pointing out, and, your time :)

    Regards


    Hi creyle,
     
    Sounds a bit like "RFE: Type >1 char selects better matches" referenced earlier in this topic.
    Wednesday, February 6, 2008 12:39 PM
  • I would like to have the ability to configure both the 32 and 64-bit versions of Dependency Walker (on 64-bit system of course) so that when "Launch Depends..." is clicked then the correct version is automatically chosen according to image type of the process.

    Sunday, February 17, 2008 2:37 AM
  • Here I will request some features after I have read various suggestions especially Mark's list:
     
    CPU-Kernel-ID# - should show the CPU or Kernel number that is executing the process - nowadays Dual CPU Quad Core Servers have 8 active CPU kernels - it would be nice to see which CPU kernel is executing which process
     
    Hide/Show Terminated processes ICON - if turning highlighting duration to higher values - for example 600sec = 10min (by changing the registry key :-) then the termination of processes could be analyzed for a longer time periode - sometimes it would be interesting to toggle away the red terminated processes to make a screenshot for example
     
    Hide/Show Suspended processes ICON - the same for suspended processes
     
    Allow higher values at Highlighting Duration - was also suggested by others - I manipulate it in the registry (nice to have)
     
    Allow different color for Suspended processes - was also suggested by others, i find it nice to have
     
    Suspending/Killing groups - to suspend processes of installed software that is used every now and then but not rregularly, it would be nice to define grouplist of processes that should be suspended by one click - this could be hierarchically - now I do this with batchfiles of pskill - but this solution lacks some sort of manageability - if suspending groups are implemented, it should be chooseable to suspend or to kill a process
     
    Grouping processes - nowadays I'm grouping processes with different words in the process comment. The comments are stored in the registry. and using them i can group processes on the screen or sorting them. The multtselect featur was suggested elsewhere.
     
    Automatic suspending/killing - at startup of PE there should be run a sheduler that is able to suspend/kill processes after a certain amount of time - after starting the PC some tasks will startup after a certain periode of time - i expierienced that after all the initial update and startup processes started worked and terminated approx 10 to 15 min can
     
    And of course the logging feature with a subset of possible variables as I described it in http://forum.sysinternals.com/forum_posts.asp?TID=9748&PN=1
     
    Adding
    Medium & Long term CPU usage - you display the actually short term CPU usage in the field CPU - the values are jumping up and down very quickly - i suggest two further CPU usage values - i call it medium and long term CPU usage - you should be able to enter two values for example 15 sec for medium term and 15 min for long term CPU usage and then there should be displayed the cumulated usage over the selected periode of time
     
    Resetting the PageFaults - to analyze the actual memory paging situation I'm not interested any more how many page faults were produced during booting - so I would prefer to be able to erase all pagefault values, so the cumulation starts new
     
    Resetting CPU Time - the same would be interesting for the cumulated CPU time to start cumulation new
     
    Then Saving the PE after 15 min - with highlight duration set to 900 I could have a logging of the 15 minutes of all running and terminated processes with cumulated CPU usage and page faults during this 15 min
     
    After I had written my suggestion I had a different idea to realize a sort of logging technique. This comes in a different
     
    Michael
    Tuesday, February 26, 2008 7:53 PM
  • In ProcExp all numbers in bars and graphs are displayed with 1 fixed decimal point, like %.1f kB, %.1f MB, %.1f GB... Especially in the Commit bar & Commit History graph, displayed memory values are suddenly too coarse when the consumption comes over 1023.9 MB -> 1.0 GB, one or two additional decimal places would be nice here. Possibly on other places in the application too... (I thought about constantly using at least three digits if available, but that's only an idea.)
     

    If some line (Process, Handle, Network connection, Thread, etc.) is selected, it is displayed "white font on blue background". If difference highlighting (red / green) should be applied to the selected line, it is not visible (and gets not noticed), the selected line is still "white on blue background". Let it behave just like in the TCPView - red or green characters on blue background - and both the difference highlighting and selection are available.
    Thursday, February 28, 2008 6:43 AM
  • A small request to the features list.
    It would be handy to have "open containing folder" option in the contextmenu of PE. This option opens the folder containing the running exe file.(its hard to open the properties of a process and copy the exe path and open run command and paste there and press enter)

    Thanks to MARK for this beautiful piece of freeware. A must have tool to ROCK windows internals
    Tuesday, March 4, 2008 11:20 PM
  • I often use restart process in right-click menu.
    But unfortunately if old process has some command line arguments - new process starts with no arguments.

    It's would be good to start new process with old arguments.
    Wednesday, March 5, 2008 2:46 PM
  • Hi Igor,
     
    What version are you using?
     
    I just invoked a process with command-line arguments and restarted it using PE 11.11.  The new process had the same command-line arguments as the old...
    Wednesday, March 5, 2008 7:16 PM
  • Hello, sorry for disturbing - just tried - it works with
    PE 11.04.

    I've another request - is it possible to know locale used for specified thread?

    Thanks
    Wednesday, March 5, 2008 11:31 PM
  • Hexadecimal PID & TID by Igort75, x-faktor
    Sunday, March 9, 2008 9:31 AM
  • Better error message when PE fails to start because there are too many handles.
     
    Monday, March 10, 2008 7:33 PM
  • can you add process explorer ability to start
    without form text

    "Process Explorer - Sysinternals: www.sysinternals.com [****]"

    like:
    http://forum.sysinternals.com/forum_posts.asp?TID=11002&PID=49083
    Saturday, March 22, 2008 2:05 PM
  • Can you add "Hard Drive activity Graph" and system tray icon.

    http://forum.sysinternals.com/forum_posts.asp?TID=14110


    Saturday, March 22, 2008 8:42 PM
  • Hi Mohammad,
     
    Not sure that the link you referenced holds information relating  to your request.  Yet, it sounds like you wish to have Process Explorer not display anything in its title bar?
    Saturday, March 22, 2008 10:30 PM
  • yes.

    because viruses could detect that and close the application using function

    GetWindowText or GetClassName
    Saturday, March 22, 2008 11:51 PM
  • I'd like to see some simple filtering options in PE.  Nothing as complex as the super granular filtering in procmon.  Simple things like being able to only show processes by a particular user or processes consuming more than N number of handles would be really great.

    Or even if it wasn't necessarily filtering, rather highlighting that could be configured to show such things, that would be plenty useful.
    Sunday, March 23, 2008 10:10 PM
  • Hi Andy,
     
    Processes running as the same user as Process Explorer are able to be highlighted with a configurable color.  Another way to easily call out the information you mentioned is to add the appropriate column to PE and sort by it.  Columns (handles, for example) will be sorted ascending or descending; for "User Name", this has the effect of grouping like usernames together.
    Sunday, March 23, 2008 10:19 PM
  • Thanks for the tip, though I dare say my column sorting skillz are quite mad.  Wink

    I was suggesting these features because I use PE often on Win 2003 Servers that are often very busy, so it would be helpful to have filter ability to weed out the noise and make it easier to see just what I want.

    Although your comment about PE highlighting the current user gives me a thought.  If I were to do a "Run as..." with PE I could not only get highlighting, but also simply uncheck the "show processes for all users" option.  But does Windows have an equivalent to the unix "su" or "sudo" commands?  Even as Administrator, when you want to do a "run as..." you need to know the user's password.  An su equivalent would allow me to run something as another user without knowing their password.
    Monday, March 31, 2008 9:32 PM
  • But does Windows have an equivalent to the unix "su" or "sudo" commands?
    Not that I'm aware. (and discussion)
    Monday, March 31, 2008 9:39 PM
  • Yes, definitely understandable for that scenario.  However 'sudo' prompts you for your own password, even when you're trying to use sudo to do something as another user besides root.  Cygwin and sudo could probably do what I want, but totally not worth the effort.

    ...yes yes...  I'm obviously a unix guy by profession.  Feel free to point and laugh at the unix guy lurking in Windows forums...  ;)
    Monday, March 31, 2008 9:52 PM
  • <offtopic>
    Cygwin and sudo could probably do what I want, but totally not worth the effort.
    I've not used Cygwin; I would be interested in knowing how a Windows sudo might work, where your own password will get you into any user's account...  From what I'm aware, short of brute-forcing, etc. this would not be possible, if the user was not already logged in.  Is that a requirement for sudo as well?
    </offtopic>
     
    Feel free to point and laugh at the unix guy lurking in Windows forums... 
    Not at all...
    Monday, March 31, 2008 10:05 PM
  • I've tried cygwin, but I didn't try the sudo command.  I think I still have it installed on a laptop at home, I'll give it a shot and post the results.
    Monday, March 31, 2008 10:16 PM
  • It would be really nice if process explorer let you copy the environment strings into the clipboard on the environment tab from the process properties. I tried to select all the environment strings with ctrl-a and then did a ctrl-c, but the strings did not get copied to the clipboard. I would like to be able to put all the environment strings in a file.
    Tuesday, April 8, 2008 4:55 AM
  • Hi rohr,
     
    Looks similar to this request:
     
    Also in this topic, here.
    Tuesday, April 8, 2008 8:33 AM
  • Molotov,

    You are right. Thank you for your response. I wonder if and when these enhancements will be made.

    Thank you.
    Tuesday, April 8, 2008 9:10 AM
  • Regarding new features / enhancements... Mark has made this comment (in the PE forum), and in the context of BgInfo, Bryce has made this comment.
    Tuesday, April 8, 2008 10:22 AM
  • In most Windows lists (including Taskman), typing the beginning of a line brings you to the entry.  In ProcExp, if I type "firefox", I end up at the first entry beginning with the letter "x".  This is an important search mechanism.

    The CPU and I/O graphs seem to have disconnected colors.  I/O and CPU use from the same process should use the same color.  The importance is probably obvious: so related activity in the two graphs can be seen, especially in the System Information view.

    Sunday, April 13, 2008 9:29 AM
  • Hi hurf,
     
    typing the beginning of a line brings you to the entry
    Seems similar to "RFE: Type >1 char selects better matches" referenced earlier in this topic (and here).
     
    I/O and CPU use from the same process should use the same color.  The importance is probably obvious: so related activity in the two graphs can be seen, especially in the System Information view.
    Unless I'm interpreting this wrong (and I probably am) this would seem to lead to cluttered graphs, with too many colors to be of use (or possibly even display).  If one wishes to see I/O and CPU activity for a process, it seems one could look at the Performance Graph of that process' properties.
    Sunday, April 13, 2008 10:12 AM
  • So... Mark had a troubleshooting blog about how he sets PE to start minimized & with the startup of Windows.  Could this be an option in the program rather than manually doing it?

    Thursday, April 24, 2008 8:26 AM
  • Hi Andy,
     
    FWIW... Matts_User_Name has also requested this in this topic:
     
    Mark has responded to some of those requests here.
    Thursday, April 24, 2008 8:43 AM
  • thanks.  i tried searching but hadn't go anywhere
    Friday, April 25, 2008 6:00 AM
  • Monday, April 28, 2008 1:07 AM
  • Feature Request:
    -Collapse Services automatically

    Most times I open PE I want to check one of my OWN programs not one of Vista's 20+ children of Services.exe ...
    Thursday, May 1, 2008 12:12 AM
  • Another excellent improvement to PE would be a window similar to System Information that would display the current and registry setting for the ever popular lanmanserver parameters that control the performance of a server.
     
    The values and keys I am referring to are located here in the registry.
    HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
     
    So, for example, if I opened the window, it would show me what maxworkitems is set to at the registry location above and what the current value is in the system and perhaps a low and high water mark for the item.
    Wednesday, May 14, 2008 10:08 PM
  • hi all :)

    Excellent Program !! :D

    these are my suggestions:

    1- option to add a column to see the affinity: when there are many open processes, costs a lot of time checking all.

    2- in the properties of a process, in the section Performance Graph only shows a graph of CPU usage. I would like to have an option to see the use in each core, like the graphic of "System Information"

    Thanks ,)
    Saturday, May 24, 2008 5:39 AM
  • I've made a request here: http://forum.sysinternals.com/forum_posts.asp?TID=14901
     
    When viewing the stack of a thread of a 32-bit process on 64-bit Vista (say, IE), it looks like I'm just seeing the 64-bit stack, not the "interesting" 32-bit stack (it starts with wow64cpu.dll!Thunk0Arg+0x5).
     
    It would be really great if PE could show the 32-bit stack.
     
    Thanks!
    Tuesday, May 27, 2008 9:33 PM
  • i have the following problem, ver. 11.13

    i have an Intel E6750

    when i open the window "System Information" each CPU graph shows the activity of each core.

    when you put your pointer on the graph, you see a pop-up informing the process causing the CPU consumption.

    but here comes the problem, when i try to find what causes a peak in core1.

    EP shows the information of core0 processes in the pop-up of core1, making it impossible to know the process causing the peak consumption in core1.

    intend to correct this detail? Thanks :)
    Friday, May 30, 2008 7:22 AM
  • I'd like to be able select much longer Refresh times then the slowest available Update Speeds 2s, 5s, 10s - like 15s, 20s, 30s, 60s, which are handy if I'd like to observe CPU/mem/IO behavior of few selected apps (keeping their property graphs opened) over longer term - hours. How to do it in the GUI? I'm aware that by adding another 3-4 entries the list would grow a bit... Maybe an additional "Custom" refresh rate entry and a freely selectable number somewhere? (I know there is currently nothing like this in the whole GUI.)
     
    (In the past I have been doing this also to lower the PE's CPU consumption, with my number of running processes and displayed columns it was usually around 5% of CPU, with v11.20 it seems to be much lower.)
     
    [bug report] One way to achieve this is manually editing HKEY_CURRENT_USER\Software\Sysinternals\Process Explorer\RefreshRate and launching a new PE instance, which has a drawback: if I specify any "unknown" number (say 20000 for 20 seconds) and Pause the periodical refresh, it can't be unPaused (to my specified refresh rate) anymore. The selection sticks to Paused and I've to select any of predefined refresh rates to unpause the GUI. Maybe repairing this would help enough.
    Thursday, June 26, 2008 12:18 AM
  • Ability of Process Explorer x64 to highlight 32-bit .NET processes.
    Friday, June 27, 2008 4:58 AM
  • I would like some display options around the tray icon.  I like the style of the Windows task manager, with a grid.  Also, the solid black background is pretty harsh; being able to select a lighter color (or transparent) would be nice.

    Thanks,
    Paul

    Monday, July 7, 2008 1:55 AM
  • <Network Info / Network Usage Display in Process Explorer>

    One particular old and popular feature request gets re-posted once in a while:

    + Feature request: network usage (reloaded)

    + enhancement : network info in Process Explorer

    </Network Info / Network Usage Display in Process Explorer>
    Wednesday, July 16, 2008 2:28 AM
  • please please, mark just add to the performance graph, cpu usage hisory,the THREAD ID of the cpu using thread spike! This is a feature i would use very often! When you use a fulle screen application and you cant see the thread 's that is taking the CPU into this process, this is a must have!
    Friday, July 25, 2008 8:01 AM
  • Monday, August 4, 2008 5:40 PM
  • Thursday, August 7, 2008 4:36 AM
  • Saturday, August 9, 2008 7:35 AM
  • Any yet another:
    On Performance tab of a process, it shows CPU usage -- it would be useful if it could tell me which thread was using the cpu -- I know 'processX' was using 100% of a cpu, but if I could tell which of the 45 threads was hogging things, I might be able to find the root of the problem -- especially when it seemed to lock up my desktop's mouse click-event processing.  It held up clicks for the whole desktop -- but it all seemed to focus on one program (firefox) that was hogging the CPU.  The problem was I still had 300% cpu left (available) out of the 400% cpu on my system.  (each 100%=1 cpu)


    Monday, August 25, 2008 12:06 PM
  • Hi Astara,
     
    Sounds similar to Jul's request.
    Monday, August 25, 2008 12:26 PM
  • I agree.  I read through the list at the beginning, but not through 14 pages of responses....

    I have a feeling that most of these features are going to fall flat on their face.

    Mark has, for the most part, been taken away from his free-win tools days -- not completely, but certainly nowhere near the resource to the community that he used to be -- but I think that was part of the point of MS hiring him as a high-level engineer -- they wanted that resource -- and they didn't want that resource handing off such useful features to the community.  :-(.

    Oh well....Everyone's gotta make a killing, er, living...don't think I would have done much different.  Darn rich corporations -- buying up all the great talent... :-)

    I asked for some of the features long before he joined MS.  Occasionally even traded emails...would be nice if he would release the tools he doesn't want to support/enhance as open-source so improving them could become community projects...now it's all tied up behind the close-source wall.  :-(


    Monday, August 25, 2008 1:50 PM
  • How about a option to save the settings to an ini file in a non multi user enviroment?
    Saturday, September 13, 2008 3:47 AM
  • Hello,
     
    I'm a new user of Process Explorer. Must thank the developers. Fantastic.
     
    Just had a suggestion for a feature maybe for a future version. When chasing rogue processes, it would be nice to have the ability to mark unverified, but trusted processes. This would make unverified, unknown (and therefore as yet untrusted) processes that much easier to pick out.
     
    Thanks
    Tuesday, September 16, 2008 5:44 AM
  • Hi David,

    You can use the Comments field for various things; perhaps you could adapt it to do what you describe.
    Tuesday, September 16, 2008 5:45 AM
  • OK I'll give that a go.
     
    Thanks.
     
    Tuesday, September 16, 2008 5:50 AM
  • What about these enhancements? by ToolsFan:
    Process Properties / Tab TCP/IP - I love this Tab. It would be even better, if I could add a column like "I/O bytes" here so I could see which data amount is transfered via each single connection/socket by this process.
    Monday, September 22, 2008 3:04 PM
  • would be nice to have "save minidump" in the context menu. I know Vista taskmanager has it, but XP uses might need it too.

    update: seems I am not the first one requesting this - so consider this msg as +1 vote %)
     
    Thursday, September 25, 2008 1:54 PM
  • Other references to "save minidump" feature request:
    Feature Request: Take a mindump of a process
    Thursday, September 25, 2008 2:31 PM
  • Monday, October 20, 2008 3:46 AM
  • Hi all sysinternals fans!

    I have to mention a feature i wish i had into PE context menu:
     
    What i want is an item to open the folder of the image path of the binary in the explorer, just like the "open the folder" item of the explorer we can see with the find files wizard. What do you think of this? :)
    regards
    Tuesday, October 21, 2008 5:53 AM
  • Hi, x-faktor.
    an item to open the folder of the image path of the binary in the explorer
    Sounds like a reasonable request. - Support++

    Sven
    Tuesday, October 21, 2008 6:49 AM
  • Hi,

    a feature that I would find very usable in process explorer is filtering of processes by name. Often when there are more than 30 processes in the list it becomes difficult to find what I'm looking for.

    It would be a great option to be able to hide from the list some processes that are always running and not making any problems.

    And btw, thanks for PE - it's an invaluable tool already as it is...

    Regards,
    Gregor
    Thursday, October 23, 2008 5:09 AM
  • The most urgent new feature we all need is process dump from memory. That would be specially useful on 64 bit system.
    Sunday, November 2, 2008 8:20 AM
  • The most urgent new feature we all need is process dump from memory.
     
    This would indeed be a great feature to have.
    Sunday, November 2, 2008 10:55 AM
  • This would indeed be a great feature to have.
    I really wonder why nobody had that idea @sysinternals team it would help to fight and analyze hotpatching malware.
    Sunday, November 2, 2008 11:10 AM
  • I haven't added a "dump process" feature because you can get that same functionality by installing the Debugging Tools for Windows package, whereupon Process Explorer will add a "Debug" item to the process context menu. When you select it, Process Explorer will launch Windbg, which then attaches to the selected process. At that point you can save a dump.
    Sunday, November 2, 2008 3:58 PM
  • whereupon Process Explorer will add a "Debug" item to the process context menu.
    I saw this debug, I tried it, I have WinDBG installed, but when I try to debug and confirm nothing happens..(maybe due to 64 bit?) Furthermore I think most would prefer additionally a direct and simple dump function.
    Sunday, November 2, 2008 4:03 PM
  • SystemPro,

    You might have a look here for ideas on how to configure the debugger:
    Introduction to x64 debugging, part 1
    Sunday, November 2, 2008 6:17 PM
  • Thanks for the reply Mark.
    Sunday, November 2, 2008 9:15 PM
  • You might have a look here for ideas on how to configure the debugger:
    Introduction to x64 debugging, part 1
    Thanks, I�ll check that.
    Monday, November 3, 2008 5:39 AM
  • Hello,
    When analysing a pb by telephone, it's easy to tell to the user to launch PE (one file, cool GUI). But if we need a mini dump, it's more difficult to ask the user to type the right commands in windbg
    Wednesday, November 5, 2008 10:20 AM
  • Today i was debugging an java/tomcat application.

    The procesexp environment tab was the tab which i needed alot, to check all the java variables etc.
     
    Those value's can be long :).
     
    And it would be a nice extra feature to be able to right click copy to clipboard an environmental value.
     
    *Right click copy value on Environment tab*
    Friday, November 7, 2008 1:42 AM
  • I have a suggestion for improvement of the Process Explorer help.
    I'd say it lacks explanation of the process performance data.
    As a good example for such an explanation you can have a look at the Windows Task Manager help topic titled "Process counter column headings" (on Windows XP Pro.).

    One of the unclear terms is "Other Bytes" in the I/O group of the process performance data.
    In the Windows Task Manager help it is explained as
    "the number of bytes transferred in input/output operations generated by a process that are neither a read nor a write, including file, network, and device I/Os. An example of this type of operation would be a control function. I/O Other Bytes directed to CONSOLE (console input object) handles are not counted."
    Friday, November 7, 2008 2:21 AM
  • Hi reni,
     
    *Right click copy value on Environment tab*
    Looks similar to this request:
     
    Also in this topic, here.
    Friday, November 7, 2008 3:20 AM
  • Hi Robert,

    process performance data
    I agree that it would be nice to have that information in the help file.  I've checked out the Performance Counter "Explain" text, or the Task Manager help file description, as you mentioned, in the past.
    Friday, November 7, 2008 3:23 AM
  • In the Lower Pane view when Dlls are shown, or also maybe for properties of a file handle that happens to be an executable binary, it would be very helpful to have a Properties Pane that exposes the COM registration for the file (from HKCR), and provides a button to Unregister the binary.

     

     

    Thanks for your consideration.

    Wednesday, November 19, 2008 8:46 PM
  • Sunday, November 23, 2008 9:09 AM
  • Note: moved user1024's post into its own topic:
    hide Process Explorer from task bar?

    The topic is essentially a +1 for Mr.Scott's request to remove Process Explorer from the task bar while keeping the main window visible.
    Tuesday, November 25, 2008 3:51 AM
  • Note: moved kluelos' post into its own topic:
    Disable Kill Confirmation dialog
    Tuesday, November 25, 2008 8:31 AM
  • Friday, November 28, 2008 11:03 AM
  • ...it would be very helpful to have a Properties Pane that exposes the COM registration for the file (from HKCR), and provides a button to Unregister the binary.


    Second that.

    GL
    Sunday, November 30, 2008 9:35 AM
  • Request to have Process Explorer save settings, when the user running Process Explorer is being logged off, discussed in:
    Missing tray icons after restart

    Friday, December 5, 2008 9:19 AM
  • Monday, December 8, 2008 5:14 AM
  • The latest release(11.31) finally shows physical memory, why not earlier?
    Thursday, December 11, 2008 6:49 AM
  • The latest release(11.31) finally shows physical memory, why not earlier?
    Has this feature not been added in P.E. v11.30, more than 20 days ago?! Wink

    Sven

    Thursday, December 11, 2008 7:19 AM
  • From 2008-11-19:

    Updates: Process Explorer v11.3, Handle v3.42 | A new Mark's blog post | 2 New Mark's webcasts: Case of the Unexplained and Inside Windows Server 2008 R2 Virtualization and VHD Improvements::
    Process Explorer v11.3: This update to Process Explorer includes numerous enhancements and bug fixes, including a physical memory history graph...




    Thursday, December 11, 2008 7:23 AM
  • Has this feature not been added in P.E. v11.30, more than 20 days ago?!
    Could be possible I was with 11.21 but 20 days more or less, I simply wondered why such a essential feature needed more then 10 years to be added.
    Thursday, December 11, 2008 12:25 PM
  • Hello,

    1- add a column to view the affinity

    2- able to select multiple processes to change the affinity, priority, etc. .. faster than do so individually.

    3- In the System Information window, add option to change the way the graphs show the CPU information when it is put your pointer over them.

    a) Default

    b) if we put the pointer in core0, show only the process that consumes more in the core0, so that we can identify it.

    Thanks :)
    Thursday, December 11, 2008 3:12 PM
  • Can we please, unless I somehow missed it, have a way to "deselect all" under set affinity, or right click to clear all but the one I clicked on.

    It sucks having to unclick each core in a dual quad system.. unless I figure a way to automate the process....
    Tuesday, January 6, 2009 1:04 AM
  • Tuesday, January 6, 2009 7:17 AM
  • Monday, January 19, 2009 5:58 AM
  • Monday, January 19, 2009 7:28 AM
  • Is it possible to put back the old "current CPU Load" tray icon?
    Tuesday, January 20, 2009 7:57 AM
  • Is it possible to put back the old "current CPU Load" tray icon?
    Also discussed in this topic:
    CPU usage in tray area
    Tuesday, January 20, 2009 8:24 AM
  • Saturday, January 24, 2009 7:59 AM
  • Feature Request:

    How about adding a "DLL Unload" feature or menu in the lower pane view when the DLL's are showed.
    Something like "Close Handle" feature...?

    Thanks

    Tuesday, January 27, 2009 7:55 AM
  • A forum search for Unload DLL shows this has been requested previously, most recently here:
    function request for process explorer
    Tuesday, January 27, 2009 9:28 AM
  • hi molotov, it would be possible to add a column to see the affinity for each process? thank you very much.
    Tuesday, January 27, 2009 9:38 AM
  • affinity column
    This feature has been requested previously, twice by you previously in this very topic...
    Tuesday, January 27, 2009 10:07 AM
  • A feature I would find useful is a roll up of resources, CPU utilization... So for example, when I collapse Snagit32.exe, it would show the resources of Snagit32.exe and also the TscHelp.exe, SnagPriv.exe, and SnatitEditor.exe. This would give me a more accurate idea of the footprint of this application.
    TIA
    Thursday, January 29, 2009 2:15 PM
  • Sunday, February 8, 2009 11:16 AM
  • Deferred Procedure Calls (DPCs) details showing me what is causing constant DPC and Hardware Interrupt usage.
     
     
    Ok Kernrates does not work in Vista 64.
    What else could I try ?
    Please advise.
    Thanks !
    Friday, February 20, 2009 12:24 AM
  • What else could I try ?
    Xperf?
    Tuesday, February 24, 2009 2:49 AM
  • would be nice to be able to click on graph (I/O, CPU, etc) to launch the properties dialog for item in tooltip.
    Wednesday, February 25, 2009 11:40 AM
  • would be nice to be able to click on graph (I/O, CPU, etc) to launch the properties dialog for item in tooltip.
    Perhaps, if the item is still running...
    Wednesday, February 25, 2009 11:44 AM
  • Hi

    It would be useful to save Environment variables of a process to text file.
    Is there another utility that could do it ?
     
    Thanks
    Sunday, March 1, 2009 11:53 PM
  • Is there another utility that could do it ?
    Not that I'm aware of...
    Saturday, March 7, 2009 9:15 AM
  • Not to promote my own program, but the latest SVN version of Process Hacker can copy all environment variables to the clipboard...

    (Sorry if this is against forum rules or something)
    Saturday, March 7, 2009 1:39 PM
  • (Sorry if this is against forum rules or something)
    Nothing wrong with answering a question! Smile
    Saturday, March 7, 2009 1:45 PM
  • OK, I hope you're not running 64-bit Windows: http://processhacker.sourceforge.net/

    Download the latest unstable release.
    Saturday, March 7, 2009 2:21 PM
  • Thank you, wj32, you've made my life easier!!! Thumbs Up
    Sunday, March 8, 2009 12:27 AM
  • Requesting: "Process Manager" tool
    I use Google Toolbar, but I *hate* GoogleUpdater.  I'm one of those people who want to chose when my software is updated. No matter how hard I try, I can never seem to catch google updating my toolbar from V4 to V5 (It updated itself again today). And Process Monitor is too bulky to be running all the time! So...
     
    Add a tool called "Process Manager" where I can create a filter (much like in ProcMon). The idea is to capture new processes and handle (pause|terminate) them as the user specifies.
     
    The Filter window- would be a near rip-off of the ProcMon filter window.
    -Where: [Process Name | Path | Command Line | {other fields}]
    -Evaluator: [is | is not | begins with | ends with | contains | excludes]
    -Text/Value: [text/value]
    -Action: [Terminate | Pause | Notify me | Pause and Notify me | Terminate and Notify me]
    -Notify: [Pay a sound, Bring Process Explorer to front | Display Popup | {etc}]
     
    Example:
    [Process Name] [Contains] ["GoogleUpdater"] [Pause and Notify me] [popup]
     
    Notification Popup would be: "Process Explorer just paused "GoogleUpdater.exe (1234)". Due to Process Manager filter #3". <OK> <Terminate> <Resume process>
     
    Justifiation:
    This would really great for troubleshooting issues where you have a hard time determining when/how a process is starting. Especially those ones that start and stop right away (Update checkers) or are triggered by user action (IExplore, Adobe, Apple).
     
    Personally, I would use:
    *jusched* = [Pause and Notify me] [popup]
    *GoogleUpdater* = [Pause and Notify me] [popup]
    *AppleUp* = [Pause and Notify me] [popup]
    *AcroTray* = [Pause and Notify me] [popup]
    *QTTask* = [Pause and Notify me] [popup]
    *isuspm* = [Pause and Notify me] [popup]
    *Updater* = [Pause and Notify me] [popup]
     
    ProcMon is a great tool to catch this sort of thing if you know exactly what and when you are looking for. But this tool would be invaluable because it could automatically Pause or Terminate the process faster than any manual action could - namely before the process delivers it's payload.
     
    Please feedback if you read this. Pro or Con.
     
    Thanks for your time,
    ControlAir
    Wednesday, March 11, 2009 3:48 PM
  • Hi ControlAir,

    My first thought is that this sounds awfully close to what some HIPS products already do...
    Wednesday, March 11, 2009 5:20 PM
  • I had a look at Process Explorer today with a resource editor and to my surprise it still contains binaries for 98/ME and Itanium Processor.
    Since Sysinternals only supports 2K/XP/Vista is there any reason to retain 2 megs of dead code??

    Richard S.
    Thursday, March 12, 2009 7:30 AM
  • Big smile I wondered when someone was going to notice that...
    Thursday, March 12, 2009 8:17 AM
  • My first thought is that this sounds awfully close to what some HIPS products already do...
     
    Molotov,
    Thank you for reading my post and commenting. It's appreciated.
    I'm not quite sure what HIPS products are. I just know that I run Process Explorer almost constantly on my computer and this just seems like a natural place for such a tool.
    Thursday, March 12, 2009 8:23 AM
  • HIPS = host-based intrusion-prevention system
    I was remembering a previous experience I had, when I had installed Comodo firewall for 2.5 hours - it seems it was asking me every time a process was started, what I wanted to do.  Presumably, there is a trainable rules-based mechanism incorporated that would seem to accomplish some / most / all of what you described.
    Thursday, March 12, 2009 8:34 AM
  • ...I was remembering a previous experience I had, when I had installed Comodo firewall for 2.5 hours - it seems it was asking me every time a process was started, what I wanted to do... 
     
    That's exactly why I would want something like "Process Manager Tool" to be added to Process Explorer. Because I don't want a product that watches everything asking me what to do with each process. I want one that only looks for what I tell it to look for. Also, I wouldn't want to use a host-based intrusion-prevention system to do basic troubleshooting. Process Explorer is a Flash-Drive program that i can use on any computer I'm working on -- which is often part of my job.
     
    Anecdotal: A few months ago, I was using PE to watch Adobe Reader do some magic:  Whenever I floated my mouse over an .PDF icon(without even clicking it), a new adobe process would magically launch. I had never seen this before and I thought of all the malicious possibilities that it implied. I can't remember what I did sine then to disable that little trick. I think it was a regedit on the .PDF filetype. I wish I had the ability to capture that process and suspend it.
     
    Also, that damned (ARGHHH - My apologies for loosing my cool) GoogleUpdater updated my toolbar again today from V4 to V5. Now I just want ANY tool that can suspend a process so I can figure out how to stop Google from those updates! Any ideas?
     
     
    Thursday, March 12, 2009 10:09 AM
  • I want one that only looks for what I tell it to look for.
    Perhaps, HIPS software has this capability ("default allow"-type behavior).

    I wouldn't want to use a host-based intrusion-prevention system to do basic troubleshooting.
    I would not classify rule-based process execution allowance decisions to be troubleshooting, or basic troubleshooting...  I personally think the feature is more appropriate for products like e.g. the referenced HIPS software.

    Now I just want ANY tool that can suspend a process so I can figure out how to stop Google from those updates! Any ideas?
    You may be interested in this topic:
    Whitelist
    Thursday, March 12, 2009 10:47 AM
  • Molotov,
    Thanks for your thoughts on this. I started to look more into HIPS and programs that can whitelist/blacklist processes. So far, I haven't found anything I want to add to my troubleshooting toolkit. But I'll eventually find something, I'm sure.
     
    I still give a +1 vote to a "Tools | Process Manager" being added to PE.  It still seems like a natural addition to me.
     
    Thanks again...
    Friday, March 13, 2009 8:47 AM

  • Driver's service name & Window's thread:
    http://forum.sysinternals.com/forum_posts.asp?TID=18353
    Sunday, March 22, 2009 5:34 PM
  • Not sure if this was requested but the ability to close TCP connections of a process with Process Explorer would be handy (without having to load up TCPView every time).

    Richard S.
    Friday, April 3, 2009 9:56 AM
  • Monday, May 11, 2009 2:55 AM
  • I'd really like the history views (I/O especially, but maybe others as well) to normalize to the range measured during the displayable period, instead of all time. I'd also like to be able to lengthen the length of the history buffer.
    Monday, May 11, 2009 1:42 PM
  • Hi,

    what do you think about something like an internal list of known processes (perhaps with md5-hash) and the possibility to hide those processes? It would be much easier to locate new processes or modified programs. In the context menu should be an option 'add to trusted processes'.  A quick button for changing the mode would be perfect.

    Frank
    Tuesday, May 12, 2009 3:19 AM
  • Hi Frank,

    Something along these lines has been suggested previously (can't recall precisely where, but I would not be surprised if it is in one of the 22 pages of posts that comprise this topic).  Embarrassed

    One thing that may be helpful is to use the Comment field on the process Properties Image tab.

    It would be much easier to locate new processes
    Add the Start Time column and sort by it?

    modified programs
    Though I don't see a column for it, the Image tab of each process' properties includes a "Time" field.
    Tuesday, May 12, 2009 3:28 AM
  • Hi molotov,

    thanks for the fast response.

    ".... suggested previously"

    Sorry, I studied just the first post with the  summarization.

    The idea with the Start Time is nice - but only for the current session. New programs in the autostart will be mixed between all other programs past next reboot.

    The idea to hide programs with a known md5-hash is better than using the Time field. Viruses don't change timestamps. There must not be a visible column for the hash. I do not want to see it. Just an internal list:
    program, md5-hash, hidden-flag

    That would keep the PE table much shorter and you would see evil new programs with one view, instead of studying (and remembering Dead - I'm beyond 50)  the hole list.

    Frank



    Tuesday, May 12, 2009 6:59 AM
  • I understand the motivation behind the request, and was offering suggestions that may get you at least a bit closer to what you were hoping for, if and until the feature may be implemented... Wink
    Tuesday, May 12, 2009 7:23 AM
  • option to start minimized within the gui, not just a command line switch
    Tuesday, May 19, 2009 10:34 AM
  • @jawz101:

    If you're starting procexp via a shortcut (in startup or otherwise), you can just change a property on the shortcut to make it start minimized.
    Tuesday, May 19, 2009 11:18 AM
  • i know but I'd like to set it in the gui.  mark often does this via the switch in a shortcut... so why not make it a gui setting
    Tuesday, May 19, 2009 12:28 PM
  • I really like CPU Usage in tray icon, but as I have Pentium Dual Core I would like to have two icons - for each core one, like in System Information.
    Sunday, May 24, 2009 10:33 AM
  • I would really like to see the ability to view the processes of remote machines.

    I'm not sure what commands/libraries you use to retrieve the processes, but wouldn't this feature be as simple as adding an option to change a command flag? (e.g. if you're using the TaskList.exe command, just add the /S flag and allow the user to input a remote station).

    I could write my own utility that would do this, but I don't really want to reinvent the wheel...especially with such an awesome utility like Process Explorer already out there. Wink

    Thanks!

    -T
    Friday, June 5, 2009 12:19 PM
  • Hi TSkull,

    Process Explorer uses NtQuerySystemInformation to obtain various information.  It is not just as simple as adding some option to some internal command.  That said, as you might imagine, you are not the first to request such a feature...
    Friday, June 5, 2009 12:33 PM
  • Hi molotov,

    Thanks for your quick reply and for filling me in. :-) I kind of figured that it would've been too good to be true for that to be the case (easy as adding some option to some command).

    That said, would there possibly be an eta on a feature like this? I understand if not...but it never hurts to ask... Smile

    -T
    Friday, June 5, 2009 1:44 PM
  • Sorry to say that I have no idea what features may be planned for Process Explorer...
    Friday, June 5, 2009 1:47 PM
  • The Process Start time shown in the left lower corner of Properties Tab of a process should contain also millseconds: e.g 16:10:30.245



    Milliseconds would also be great in the Columns



    Ciao and thanks

        Hermann

    Wednesday, June 10, 2009 9:15 AM
  • Thursday, July 2, 2009 2:25 AM
  • Feature Request: "Secure" RunAs!

    Process Explorer already has Run as Limited User, but how about giving it an UAC-like Secure RunAs that can be used on XP, too? I mean, the possibility to use Process Explorer to run something as administrator with the login dialog in a secure desktop, like that of UAC, so the admin password can't be keylogged by any malware running in the limited account. That would be a useful feature. I already suggested that for a stand-alone tool, but it would be cool in Process Explorer, too. �

    Thursday, August 6, 2009 3:23 AM
  • Hello,
    I vote also for this feature request. A proposal could be to handle "Ctrl+C" to copy the selected environment variables into the clipboard.
    This will solve the pb of viewing long environment variables



    Hi
    It would be useful to save Environment variables of a process to text file.
    Is there another utility that could do it ?

    Thanks
    Monday, September 7, 2009 4:12 AM
  • Try Process Hacker. Ctrl+A, Ctrl+C, paste in Notepad or something.
    Monday, September 7, 2009 3:53 PM
  • This is a good idea - add to this the ability to manually retry the verification for those that timed out.  In other words don't grey out the Verify button.
    Friday, September 18, 2009 7:18 AM
  • I wonder if Mark will one day make Process Explorer open source.
    Friday, September 18, 2009 2:32 PM
  • A feature I would like to have in Windows 7 :
    a "Run as Administrator" Jump list command in process explorer's icon.

    For the moment, I launch process explorer with CTRL+MAJ+ESC, and it launch himself as a normal user (normal). But I often need to do something as administrator, and as I don't have any shortcut, I must dig to my folders to find the .exe, right click on it > Run as Administrator. It would be a nice thing to have.
    Sunday, September 27, 2009 2:18 AM
  • I wonder if Mark will one day make Process Explorer open source.


    That would be good, so we could implement at least one of these 10000 feature requests and release PE v11.34...
    Monday, September 28, 2009 1:19 AM