Windows sysinternals

Chapter 3 Process Explorer 43
for processes not running in the current user’s logon session. Procexp depends on the
Debug Programs privilege (which is granted to Administrators by default) to do this.
Environments that adopt security policies that do not grant the Debug Programs privilege
to Administrators will not be able to take full advantage of Procexp’s capabilities. Procexp
makes a best effort to display the information that it can, and it leaves fields blank or reports
“access denied” when it can’t.
Note On Windows Vista and newer, even full administrative rights are not sufficient to read
detailed information from protected processes. The Audiodg.exe and System processes are
protected processes, which Procexp reports on the security page of the process’ Properties
dialog box.
To run Procexp with administrative rights on Windows XP and Server 2003 if you are not
already logged on as an administrator, you must use RunAs to launch Procexp, or start
Procexp from another program (such as Cmd.exe) that is already running as an administrator.
On Windows Vista and newer, the Run As Administrator option can serve an equivalent
purpose.
On Windows Vista and newer, Procexp offers two additional options. If Procexp is running
nonelevated, choosing Show Details For All Processes from the File menu restarts Procexp
with User Account Control (UAC) elevation. The second option is to start Procexp with the
/e command-line option, which also requests UAC elevation. (Of course, you must be running
in a context in which elevation is possible.)
See the “Administrative Rights” section in Chapter 2 for more information on RunAs and UAC
elevation.
Main Window
The process list is a table in which each row represents a process on the system, and the
columns represent continually updated attributes of those processes. You can change which
attributes are displayed, resize and reorder the columns, and save column sets for later
use. The Procexp toolbar includes buttons for performing common actions and graphs
representing systemwide metrics. Finally, the status bar shows user-selectable system metrics.
Each of these features will be described in turn.
Process List
Each row in the process list represents a running process on the local computer. Actually,
that’s not technically accurate. As my friend and Windows Internals co-author David Solomon
likes to point out, processes do not run—only threads can run. Threads—not processes—are
the entities that Windows schedules for execution and that consume CPU time. A process
www.it-ebooks.info