How to get the command that invoked a task with tasklist?

Solution 1:

How about this one:

wmic process where caption="test.exe" get commandline

And if you do this you also get the ProcessId to kill:

wmic process where caption="test.exe" get commandline,processid

wmic also has a switch to output to csv. So:

wmic /output:c:\temp\proc.csv process where caption="test.exe" get commandline,processid /format:csv

Note: If you get an error with the last one (Invalid XSL format (or) file name) you need to copy csv.xml from %WINDIR%\System32\wbem\en-US to %WINDIR%\System32\wbem. You can read about this bug here.

You could also use PowerShell:

Get-WmiObject win32_process -Filter "name like '%test.exe'"|select CreationDate,ProcessId,CommandLine|ft -AutoSize`