{"id":156,"date":"2008-04-04T19:31:30","date_gmt":"2008-04-04T14:01:30","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/list-running-processes-and-their-creation-times\/"},"modified":"2019-05-12T03:00:13","modified_gmt":"2019-05-12T03:00:13","slug":"list-running-processes-and-their-creation-times","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/list-running-processes-and-their-creation-times\/","title":{"rendered":"List Running Processes And Their Creation Times"},"content":{"rendered":"

The Windows Task Manager does not list the creation time and date of running processes. To get this info, you may use one of these methods.<\/p>\n

Process Explorer<\/h2>\n

Process Explorer<\/a> is an excellent tool from Microsoft Sysinternals which shows a list of the currently active processes, along with many other important details. To view the process creation time, click the View<\/i> menu in Process Explorer<\/em>, and click Select Columns…<\/i> In the Process Performance<\/i> tab, place a checkmark near the option Start Time<\/i>, and click OK<\/strong>. Process Timeline<\/i> column may be useful, as well.<\/p>\n

\"Process<\/p>\n

Now you’ll see an additional column named Start Time, shown at the last<\/strong>. You may drag the column to the beginning if needed.<\/p>\n

\"Process<\/p>\n

WMI Script<\/h2>\n

Another option to get the list of running processes (along with their creation time) is using WMI, using CreationDate<\/i> property in the Win32_Process<\/a> class. Here is a small script:<\/p>\n

Set objFS = CreateObject("Scripting.FileSystemObject")\r\nSet objNewFile = objFS.CreateTextFile("ProcessList.txt")\r\nstrComputer = "."\r\nSet objWMIService = GetObject("winmgmts:" _\r\n& "{impersonationLevel=impersonate}!\\\\" _\r\n& strComputer & "\\root\\cimv2")\r\n\r\nSet dtmProcTime = CreateObject( _\r\n"WbemScripting.SWbemDateTime")\r\n\r\nSet colProcesses = objWMIService.ExecQuery( _\r\n"select * from win32_process" )\r\n\r\nFor Each objProcess In colProcesses\r\nstrOutput = strOutput & _\r\nobjProcess.Name & " (" & objProcess.ProcessID & ")"\r\n\r\nIf NOT IsNull(objProcess.CreationDate) Then\r\nstrOutput = strOutput & vbTab & _\r\ngetmytime(objProcess.CreationDate)\r\nEnd If\r\n\r\nIf NOT IsNull(objProcess.ExecutablePath) Then\r\nstrOutput = strOutput & vbTab & _\r\nobjProcess.ExecutablePath\r\nEnd If\r\nstrOutput = strOutput & vbCrLf\r\nNext\r\nobjNewFile.WriteLine strOutput\r\n\r\nFunction getmytime(wmitime)\r\ndtmProcTime.Value = wmitime\r\ngetmytime = dtmProcTime.GetVarDate\r\nEnd Function<\/code><\/pre>\n
Copy the above code to Notepad and save the file as Proclist.vbs. Double-click the file to execute it, and it creates a text file named ProcessList.txt<\/strong> in the same folder where the script resides.<\/p>\n
\"list<\/p>\n
The text file contains the list of process names with their creation times, sorted in chronological order.<\/p>\n
Using WMIC<\/a> (WMI’s Command-line tool)<\/h2>\n
To get the list of running processes with their creation times, open a Command Prompt window (CMD.EXE) and type the following command:<\/p>\n
WMIC PROCESS GET NAME, CREATIONDATE<\/pre>\n
Press ENTER. You’ll see output similar to below:<\/p>\n
20160608113122.658330+330 chrome.exe\r\n20160608114051.136181+330 ShellExperienceHost.exe\r\n20160608114422.533003+330 NisSrv.exe\r\n20160608114515.118887+330 dllhost.exe\r\n20160608114916.195621+330 chrome.exe\r\n20160608115108.793552+330 chrome.exe\r\n20160608115516.446428+330 Greenshot.exe<\/pre>\n
The date\/time stamp is shown in the following WMI time format<\/a>:<\/p>\n
yyyymmddHHMMSS<\/i><\/pre>\n
To understand the WMI date and time format and to convert it to usual format, see article Converting WMI Dates to a Standard Date-Time Format<\/a> at Microsoft Windows Scripting Guide Website.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Windows Task Manager does not list the creation time and date of running processes. To get this info, you may use one of these methods.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[7],"tags":[480],"class_list":["post-156","post","type-post","status-publish","format-standard","hentry","category-windows","tag-scripts"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3346,"url":"https:\/\/www.winhelponline.com\/blog\/procmon-track-process-creation-exit-time\/","url_meta":{"origin":156,"position":0},"title":"Track Process Creation and Exit Time Using Process Monitor","author":"Ramesh","date":"June 21, 2016","format":false,"excerpt":"Summary: This post tells you how to track process creation and exit events using the Process Monitor utility. My previous post, List Running Processes, helps you track down currently running processes. And the article Command Prompt Opens and Closes immediately\u00a0tells you if a last run program window was a scheduled\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"process creation and exit time","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":42,"url":"https:\/\/www.winhelponline.com\/blog\/configure-task-manager-to-display-full-path-of-running-processes\/","url_meta":{"origin":156,"position":1},"title":"Task Manager: Show Command-line and Image Path of Running Processes","author":"Ramesh","date":"March 3, 2008","format":false,"excerpt":"Out of all the built-in troubleshooting tools in Windows, Task Manager is probably the most useful tool. Almost every end-user knows what to do when an application stalls. They just fire up Task Manager using Ctrl + Shift + Esc and end the nonresponsive task. Also, Task Manager can be\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"task manager show command line","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/03\/taskmgr_command_line_4.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":895,"url":"https:\/\/www.winhelponline.com\/blog\/services-svchost-windows\/","url_meta":{"origin":156,"position":2},"title":"Multiple Svchost.exe in Task Manager; View Services Running Under Each Svchost.exe","author":"Ramesh","date":"May 2, 2009","format":false,"excerpt":"Svchost.exe is a process that hosts Windows services to perform various functions. There can be multiple instances of svchost.exe (host process for Windows services) running on your computer, with each instance containing different services. Especially on Windows 10 v1709 and Windows 11, you might see 50+ Svchost.exe processes. Using Task\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"process explorer - svchost.exe - list of services","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/05\/procmon-svchost-services-list.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/05\/procmon-svchost-services-list.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/05\/procmon-svchost-services-list.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/05\/procmon-svchost-services-list.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":1107,"url":"https:\/\/www.winhelponline.com\/blog\/determine-program-process-owns-error-message-window\/","url_meta":{"origin":156,"position":3},"title":"How to Find Which Program Owns an Error Message Window","author":"Ramesh","date":"November 8, 2010","format":false,"excerpt":"Error message dialog boxes usually have title bar text containing the application or process name that generated the error. However, you may sometimes encounter a pop-up window with no text in the title bar, making you guess which program has caused the error. Let's say 100+ processes are showing up\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"process explorer find window handle - drag and drop","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":1062,"url":"https:\/\/www.winhelponline.com\/blog\/resource-monitor-find-process-locked-file-windows-7\/","url_meta":{"origin":156,"position":4},"title":"How to Use Resource Monitor to Find Which Process Has Locked a File","author":"Ramesh","date":"July 21, 2010","format":false,"excerpt":"Many folks use Process Explorer from Windows Sysinternals to gather information about running processes and their open handles. In addition, there is an excellent but less familiar utility in-built with Windows 7 and higher (including Windows 10\/11). The built-in utility is Resource Monitor, which provides complete details of running processes,\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"openfiles","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/openfiles-4.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1166,"url":"https:\/\/www.winhelponline.com\/blog\/determine-parent-process-of-running-process\/","url_meta":{"origin":156,"position":5},"title":"How to Determine the Parent Process of a Running Process in Windows?","author":"Ramesh","date":"June 3, 2012","format":false,"excerpt":"You may have come across situations where a continuous hard disk activity taking place although your system being in an idle state. If you open Task Manager out of curiosity, you may find several processes starting and exiting of their own without you doing anything. It could be a scheduled\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=156"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/156\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}