Process Explorer in Windows 10: An advanced Task Manager (EXPLAINED)
The Task Manager on Windows 10 provides a detailed look at the apps and services that are running on the system. For many users, it provides sufficient details about the apps and services that are running, but in some cases, it falls short.
The Task Manager limits itself to showing the CPU, Memory, Disk, Network, GPU usage, and the Process ID. It can tell you what’s dragging your system down and let you quit an app that isn’t responding. It is a reasonable troubleshooting tool, but it does fall short at times.
What Is Process Explorer?
When Task Manager fails to provide enough information about an app, process, or service, the number one go-to tool is Process Explorer.
It is part of the Sysinternals suite of apps, available directly from Microsoft. Think of it as a more sophisticated task manager that can provide details the stock Task Manager cannot.
The tool can identify files that are in use by an app, and it can identify which process (or app) is accessing a particular DLL file.
Process Explorer is a Microsoft Sysinternals tool. The current official release is v17.12, and Microsoft officially supports it on Windows 11 and higher on the client side, and Windows Server 2016 and higher on the server side. If you are running Windows 10, many of the steps and features described in this article still apply, but the current official support documentation has moved on to newer platforms.
Process Explorer Features
Here’s what this utility is and does:
- A process/app identifier that allows users to drag and release a target icon onto an app window. The related process is highlighted in the tool.
- A detailed list of all the directories i.e., folders and files that a particular process or app is accessing while it runs.
- A detailed look at the registry keys that are associated with a process or app.
- A CPU and GPU graph for each app that is currently running, allowing you to see the impact of an app on your system’s resources.
- Search for handlers and find which apps are using them.
- Kill or suspend a process.
- Can replace Task Manager.
- Submit a process to VirusTotal for malware analysis.
- Kill an entire process tree instead of just one process at a time.
To understand how to use those features effectively, it helps to know how the interface is laid out. Process Explorer uses a two-pane design. The top pane displays the active process tree, showing every running process organized by parent-child relationship, along with the user account that owns each process. This alone makes it far more informative than Task Manager at a glance.
The bottom pane is context-sensitive and changes depending on which mode you have selected. In Handle mode, the bottom pane shows all open handles for the process you have selected in the top pane — this includes open files, folders, registry keys, and other system objects. In DLL mode, it shows every DLL and memory-mapped file that the selected process has loaded. Switching between these two modes is how you do most of the real diagnostic work in Process Explorer.
The built-in handle and DLL search (Find menu > Find Handle or DLL) lets you type a file name, folder path, or library name and immediately see which process or processes currently have it open. This is the fastest way to answer the classic question: “What program is holding onto this file?”
Process Explorer Usage
This is a more advanced Task Manager, so it begs the question: when exactly should it be used?
The tool is best used when you have to identify which app has a file open. You can also use it to find the process associated with a specific app.
Process Explorer can show you the open registry handles that a running process is currently using, giving you visibility into which registry keys an app is actively accessing. However, it is not a registry editor — it cannot modify or remove registry entries. If you need to clean up leftover registry keys after uninstalling an app, use the built-in Registry Editor (regedit) or Autoruns, another free Sysinternals tool that specializes in startup entries and persistent registry values.
Another practical use case is suspending a process to reduce its system usage to zero without having to kill the app entirely. This is a great way to free up system resources without having to close the session and start anew when you want to return to the app later, though if you instead need to terminate stubborn Windows apps, Process Explorer can also help you identify and end the offending process.
You can also view how processes and apps change over time using the color-coded system the tool provides. View the legend for the colors by going to Options > Configure Colors.
Process Explorer is particularly useful when you need to trace CTF loader process activity or investigate other system processes that may be consuming resources unexpectedly.
Practical Troubleshooting Workflows
Here are the most common real-world scenarios where Process Explorer does things Task Manager simply cannot:
Finding which process is locking a file. If Windows tells you a file is in use and won’t let you move, delete, or overwrite it, go to Find > Find Handle or DLL in Process Explorer, type part of the file name, and click Search. The results will show you exactly which process holds an open handle to that file. You can then right-click the process and close the handle, or kill the process entirely, to release the lock.
Diagnosing DLL conflicts. Switch the bottom pane to DLL mode, select a suspect process in the top pane, and scan the list of loaded libraries. You can see the full path of every DLL loaded into that process, which helps you spot mismatched versions, DLLs loaded from unexpected locations, or a library that is being shared with another conflicting application.
Telling apart similarly named processes. Windows often runs multiple instances of processes with identical names — svchost.exe is the most common example. In Process Explorer, right-click any process and choose Properties to see the full image path, command-line arguments, and the parent process. This lets you quickly distinguish between a legitimate system process and something suspicious using the same name.
Investigating CPU, memory, or I/O spikes over time. Open the Properties window for a process and navigate to the Performance or Performance Graph tabs. These show historical CPU, memory, and I/O activity for that specific process since it launched, making it much easier to confirm whether a spike was a one-time event or an ongoing problem.
Process Explorer Limitations
This is a powerful tool, but it has a challenging UI. It’s enough to intimidate anyone trying to learn it for the first time.
Even after you figure the interface out, it remains very busy and cluttered. The color-coding, while useful, isn’t easy to remember because the app makes use of a large number of distinct colors. New users may find themselves consulting the legend frequently until the color scheme becomes familiar.
Conclusion
Process Explorer can be set as the default Task Manager on Windows 10. Whether you need it as the default task manager depends on how often you need to troubleshoot something and how often the built-in Task Manager falls short of providing the information you need. It is a great utility and should be in your toolbox of troubleshooting tools.
My challenge is resource causing Office App freeze when need arise to open a large document in the middle of several apps running. I really prefer ez way to avoid closing apps and reopen them etc as solution.
Therefore, I am considering suspending apps which sounds like putting them to sleep; after I finished said large document, then I resume them & continue with my previous task seamless.
But Process Explorer shows too many processes that I don’t think I need to see.
Is it possible to show
Ⓐ only Office Apps?
Ⓑ Group some processes to make it ez to Suspend/Resume instead of each process
Ⓒ how to use Process Explorer to ⒈ prevent freezing of Office App ⒉detect high risk of freezing