Process Explorer Tips and Tricks

Struggling to identify a window’s parent process or thread? Open Process Explorer, then drag the target-like icon next to the binoculars icon on to the window in question, and its associated thread is highlighted.

Click the binoculars icon or press Ctrl-F to open the search tool—this enables you to search by handle or DLL substring to see which processes are using (and possibly holding on to) resources. If you can’t access a file because “it’s open in another program,” this can find what’s locking it.

Choose “View > Select Columns,” and you’ll see you can view pretty much any kind of data about a process or thread that you want. Most useful views can be found on the “Process Image” (for additional info about the process) and “Process Performance” tabs (check “CPU History,” for example, to track a process’s resource consumption over time on a graph). Many of these options are overkill, but Google any terms to find out more about them. Also take the time to look at the “Handles” and “DLL” tabs—you can add extra information to both panes.

We like running Task Manager and Process Explorer together, but if Process Explorer offers all the functionality you need, you can make it your default task manager—choose “Options > Replace Task Manager.” Now, pressing Ctrl-Alt-Del or right-clicking the Taskbar and choosing “Task Manager” launches Process Explorer.

Should you wish to reset Process Explorer to its defaults, right-click its system tray icon, and choose “Close Process Explorer.” Press Win-R, type “regedit,” and hit Enter. Navigate to “HKEY_CURRENT_ USER\SOFTWARE\Sysinternals.” Rightclick the “Process Explorer” subkey, choose “Delete,” then close Registry Editor.