Process Explorer is a Windows Sysinternals utility for inspecting running processes, open handles, and loaded DLLs, helping administrators and developers investigate locked files, resource usage, and application problems.
Process Explorer is a Windows Sysinternals utility that connects running processes with the files, handles, and DLLs they use. It helps administrators, developers, and support staff investigate application behavior beyond a simple list of running programs. Select a process to inspect its open objects or loaded modules, then use search to identify other processes referencing a particular resource. This makes the application useful when a file cannot be replaced, a program loads an unexpected library, or resource usage needs closer examination. Its live view supplies evidence about the current system state, helping you choose a focused next step during troubleshooting.
Process Explorer runs directly from its extracted download package, without a conventional installation wizard. Microsoft's current compatibility listing specifies Windows 11 or later for clients and Windows Server 2016 or later for servers. Autoruns complements this live process inspection by showing automatic startup configurations, helping investigate why an application returns after logon or reboot. The two views answer different questions: what is running now and what is configured to launch later. Access to some process details depends on permissions and Windows protections. Advanced investigations using symbols also require correctly configured debugging components and symbol paths; downloading the utility alone does not configure those dependencies.
Process Explorer helps you replace broad troubleshooting guesses with evidence tied to a particular process or resource. Finding the application that holds an open file can let you close that application normally instead of restarting the entire computer. Inspecting loaded library paths can reveal that a program uses a different component than expected, giving support staff a specific version or location to investigate. Account ownership adds context when several users or background services are active on the same machine. These details also improve handoffs: a report can name the process, affected file, and loaded module rather than describing only an intermittent symptom. For developers, repeated inspection can help narrow a suspected handle leak before deeper debugging begins. The main benefit is a more targeted investigation, with fewer unrelated changes and clearer evidence for deciding whether to adjust an application, update a component, or escalate the issue.
Key capabilities and highlights.
Process Explorer displays currently active processes in its main view, giving you a starting point for examining application activity. Select an entry to connect the running program with more detailed information below. This helps distinguish a visible application from the background processes that also participate in a Windows session.
The process list identifies the accounts that own running processes. This adds useful context when user applications and service activity appear together, particularly on shared computers. Ownership can help explain why a process belongs to another session, although an account name alone does not establish the program's purpose or trustworthiness.
Handle mode in Process Explorer shows the handles opened by the selected process, including references to files, Registry keys, and other objects. Inspect these references when investigating resource access or a suspected handle leak. An open handle identifies a relationship with an object; it does not necessarily indicate a fault.
DLL mode lists the libraries loaded into a selected process, helping you examine which components an application actually uses. This is useful when troubleshooting an unexpected module or a suspected library-version mismatch. Inspecting the loaded file provides stronger context than assuming the application uses whichever DLL appears in its installation folder.
The module view also exposes memory-mapped files associated with a process. These mappings show another way an application can reference file-backed data beyond ordinary file handles. Reviewing them can clarify why a file remains associated with a running program during an investigation of access, replacement, or application resource behavior.
Process Explorer searches across processes for matching handles or loaded DLLs, reducing the need to inspect every entry individually. Search for a relevant file or module name, then examine the owning process. This workflow is useful when the resource is known but the application using it is not.
The interface pairs a process list with a lower detail pane that follows your selection. Switch the lower pane between handle and DLL modes to examine different aspects of the same program. This keeps the process context visible while you move from identifying an application to inspecting its resources.
Process Explorer supports symbol configuration for deeper investigations that need debugging information. Configure the debugging library and symbol path, including the supporting symbol-server component when required. This helps advanced users interpret available symbolic information, but useful results depend on obtaining symbols that match the modules being examined on the system.
Browse historical releases and previous builds.
Common questions about Process Explorer.
Yes. Microsoft provides it without a purchase charge as part of Sysinternals. It is proprietary software governed by Microsoft's applicable license terms, rather than an open-source project.
Microsoft's current product page lists Windows 11 and later for client systems, and Windows Server 2016 and later for servers. These are the published compatibility requirements for the currently listed release.
Its handle and DLL search can identify processes referencing a matching file or module. Inspect the result and close the owning application normally when appropriate. A matching reference helps the investigation but does not explain every possible access-denied condition.
No. Its main purpose is inspecting process state, open handles, and loaded modules. For an event-by-event trace of file-system, Registry, and process activity, Microsoft's separate Process Monitor utility serves that workflow.
Termination can discard unsaved work or interrupt services. Use the inspection details to identify the application first, then try its normal exit or recovery procedure. Ending a process also does not correct the underlying cause of a recurring problem.
Process Explorer is a Windows Sysinternals utility for inspecting running processes, open handles, and loaded DLLs, helping administrators and developers investigate locked files, resource usage, and application problems.
IIS Service Monitor is the Windows entrypoint process for IIS inside Windows Server containers, watching the w3svc service and promoting container environment variables into the application pool.
Azure Monitor Agent is Microsoft's unified telemetry agent for Windows and Linux machines, collecting logs and performance data and routing it to Azure Monitor through centrally managed data collection rules.
Power Automate for desktop is Microsoft's robotic process automation app for Windows. It builds low-code desktop flows that automate repetitive work across applications, websites, files, and email, and Power Automate for desktop can start from a button, a schedule, or an event.
PowerShell is an object-based command shell and scripting language for automating administration, managing systems, processing data, and building repeatable operational workflows.
Comments