Chapter 9 · Processes

Practical Lab: Exploring Processes

5 min read

Objective

See processes on your own PC: their IDs, memory, handles, threads, parents and loaded DLLs. You only look (and start and close Notepad). Nothing in this lab changes a Windows setting.

Time: 25–30 minutes
You need: A Windows PC. No extra software is required. (One free optional tool is named in Part 5.)

What to Open

ToolHow to open it
Task ManagerPress Ctrl + Shift + Esc
PowerShellPress Win, type PowerShell, press Enter (normal, not admin)
Command PromptPress Win, type cmd, press Enter
Resource MonitorPress Win + R, type resmon, press Enter

Part 1: The Processes Tab and Details Tab (Task Manager)

  1. Open Task Manager. On the Processes tab, count the entries under Apps and under Background processes and Windows processes.

  2. Open Notepad (and leave it open). Find it under Apps.

  3. Switch to the Details tab. Right-click any column header and choose Select columns. Tick: PID, Threads, Handles, Memory (private working set), Commit size, Command line, User name, Elevated (and Status if you like).

  4. Find notepad.exe. Fill in:

    1. PID of Notepad: ________________
    2. Threads: ________________
    3. Handles: ________________
    4. Memory (private working set): ________________
    5. User name: ________________
    6. Status (Running or Suspended): ________________

  5. Click the PID header to sort. Look at the top: System Idle Process has PID 0 and System has PID 4 (Section 5.1).

Part 2: The Same Facts From the Command Line

Type each line and press Enter:

Get-Process notepad | Select-Object Name, Id, Handles, Threads
tasklist /FI "IMAGENAME eq notepad.exe"
  1. Is the PID the same as in Task Manager? ________________

Now start a second Notepad and compare:

Start-Process notepad
Get-Process notepad | Select-Object Id, StartTime, WorkingSet64
  1. How many Notepad processes are there now? ________________
  2. Are the PIDs different? (One program file, two processes, Section 1.2) ________________

Part 3: Memory Per Process

Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 Name, Id, @{n="WorkingSetMB";e={[int]($_.WorkingSet64/1MB)}}
  1. Which program uses the most memory? ________________ How many MB? ________________
  2. In Task Manager, compare Working set and Commit size for it. Which is bigger? ________________ (Section 4.1)

Part 4: Parent and Child

Get-CimInstance Win32_Process -Filter "Name='notepad.exe'" |
  Select-Object ProcessId, ParentProcessId, CommandLine
  1. What is the ParentProcessId of Notepad? ________________
  2. Find that PID in the Details tab. Which program is the parent? ________________ (Probably explorer.exe, or powershell.exe if you started it from there.)

Orphan test (safe). In PowerShell type:

$p = Start-Process powershell -PassThru
$p.Id

A new PowerShell window opens. Note its PID, then in the new window run:

Get-CimInstance Win32_Process -Filter "ProcessId=$PID" | Select-Object ParentProcessId

Now close the first PowerShell window (the parent). Look in Task Manager.

  1. Is the second window still running? ________________
  2. Does its recorded parent PID still show the same number? ________________ (Section 10.1: no re-parenting on Windows)

Part 5: Handles and Modules

  1. In the Details tab, sort by Handles (click the header twice for highest first). Which process has the most? ________________
  2. List the DLLs loaded in Notepad:
(Get-Process notepad | Select-Object -First 1).Modules | Select-Object ModuleName | Select-Object -First 15
  1. Do you see ntdll.dll and kernel32.dll? ________________ (Section 8.1)

Optional: Sysinternals Process Explorer (free from Microsoft, optional). It is not part of Windows; download it only from Microsoft's official site. It shows the process tree, the handles of each process, and the DLL list in a lower pane (View, Lower Pane View, Handles or DLLs).

Part 6: Watch a Process End

$p = Start-Process notepad -PassThru
$p.Id
Stop-Process -Id $p.Id
  1. Did Notepad vanish at once with no "save changes" question? ________________ (Section 3.2: forceful end, no cleanup)

For an exit code in Command Prompt:

cmd /c exit 7
echo %ERRORLEVEL%
  1. What number prints? ________________ (Section 3.1)

What Should Happen

  • Part 1 and 2 show the same PID for Notepad.
  • Part 2 shows two different PIDs for two Notepad windows.
  • Part 4 shows the parent as Explorer (or the shell that started it). The orphaned PowerShell keeps running after the parent closes.
  • Part 5 shows ntdll.dll and kernel32.dll in every process's module list.
  • Part 6 prints 7.

Interpretation Guide

What you seeWhat it means
A process with 0% CPUBlocked or ready, not running (Section 7)
Status: Suspended on an appA Store app frozen in the background
Handles keeps rising for one processPossible handle leak (Section 5.3)
Private working set keeps risingPossible memory leak (Section 4.4)
(32 bit) after a nameA 32-bit program on 64-bit Windows (WOW64)
ParentProcessId points to nothing in the listParent already exited: an orphan (Section 10.1)
Many svchost.exe entriesWindows service host processes. Normal
Elevated: YesThe process runs as an administrator

Follow-Up Questions

  1. Why are the two Notepads separate processes even though they use the same file?
  2. Why can the same PID later belong to a different program?
  3. Name two things that Task Manager's Details tab shows that the Processes tab does not.
  4. When you closed the parent PowerShell, why did the child keep running?
  5. Which is bigger on your PC, a process's commit size or its private working set, and what does the difference mean?