Welcome to the Taskmon user manual. Taskmon is designed to be a fast and keyboard-friendly alternative to the standard Windows Task Manager.
- View all running processes and sort them by various resource usage metrics.
- Switch between a Processes tab and a Services tab with Ctrl+Tab, or with the arrow keys on the tab strip.
- Find a process or service by name with Ctrl+F, then step through the matches with F3 and Shift+F3.
- Start, stop, and restart Windows services, and jump from a service to the process hosting it.
- Choose from over 65 customizable columns to display; see Available Columns below for the full list.
- Switch to a hierarchical Process Tree view to see which processes launched which; see Process Tree View below.
- Available as a portable executable or via a Windows installer. Portable copies keep their settings alongside the executable so you can carry them on a USB drive; installed copies store settings per-user automatically, since Program Files isn't writable without administrator rights.
- Optionally replace the system Task Manager during installation, so Ctrl+Shift+Esc and the taskbar's "Task Manager" entry open Taskmon instead.
- Minimize to the system tray to keep your taskbar clean.
- Optionally launch Taskmon already minimized to the tray, with no window shown on startup.
- Hover over the system tray icon for a tooltip you write yourself, from a short list of tokens.
- Suspend, resume, or terminate processes directly from the list.
- Change the priority class of any running process.
- Launch new tasks directly from the application.
- Restart Taskmon as administrator from the File menu to manage processes you don't otherwise have access to.
- Keep Taskmon Always on Top via the View menu.
- Configurable auto-refresh interval (Off, 5 seconds, 10 seconds, 30 seconds, 1 minute).
- Remembers your window size, position, and column choice and order across sessions.
- Option to disable the end task confirmation prompt for faster workflow.
Taskmon can display processes as a hierarchical tree instead of a flat list, grouping each process under the parent that launched it.
- Press Ctrl+T, or choose View > Process Tree, to toggle between the list and tree views.
- Expand or collapse a process's children using the tree's disclosure triangles or the keyboard.
- Right-click a process in tree view for an additional End process tree action, which terminates that process and all of its descendants, ending the children before their parents.
The text you get when hovering the tray icon is a template you control. Set it under System tray tooltip on the General tab in Settings.
Anything you type is kept as-is, and these tokens are replaced with live values:
{cpu}: processor use across the whole system, as a percentage.{mem}: physical memory in use.{mem_total}: total physical memory.{mem_percent}: physical memory in use, as a percentage.{processes}: number of running processes.{threads}: number of threads.{handles}: number of open handles.
The default is CPU {cpu}%, {mem} memory used. Something like {mem_percent}% memory, {processes} processes works just as well.
Every value is read straight from the kernel rather than from the process list, so the tooltip shows the same thing whichever tab you have open, and it keeps updating while the window is hidden. A token you misspell is left in the tooltip unchanged, so you can see what went wrong.
- Press Ctrl+F to open the Find dialog, type part of a name, and press Enter. Taskmon selects the first match.
- F3 moves to the next match and Shift+F3 moves to the previous one. Both wrap around the end of the list.
- The search is not case sensitive and matches anywhere in the name, so "host" finds svchost.exe.
- Find always works on the tab you are looking at. On the Processes tab it searches process names, in either the list or the tree. On the Services tab it searches both the service name and the display name, so either wuauserv or Windows Update finds the same row.
- In the process tree, a match inside a collapsed branch still counts. Taskmon expands whatever it needs to show you the result.
- Pressing F3 before you have searched for anything opens the Find dialog rather than doing nothing.
The Services tab lists every Windows service, whether it is running or not.
- Press Ctrl+Tab to move between the Processes and Services tabs, or Tab to the tab strip and use the Left and Right arrow keys.
- Shown by default: Name, Display Name, Status, Startup Type, and PID. A blank PID means the service is not running.
- Also available, off by default: Log On As (the account the service runs under), Binary Path (the command line Windows starts it with), Service Type (own process, shared process, or a per-user copy), and Group (the load order group, which most services leave empty).
- All columns except Name can be hidden or reordered from the Columns tab in Settings, independently of the process columns.
- Sorting works exactly as it does on the Processes tab; see Column Reordering and Accessible Sorting below.
- Right-click a service, or press the context menu key, for Start, Stop, Restart, and Go to process. Start and Stop grey out when they do not apply.
- Go to process switches to the Processes tab and selects the process hosting that service.
- Controlling a service needs administrator rights. If you are not elevated, Taskmon tells you and points you at File > Restart as administrator.
All columns are optional except Name, which is always shown. Enable the ones you want from the Columns tab in Settings (Ctrl+,); Name, PID, CPU %, and Memory are shown by default.
- Name: The process's executable name.
- PID: The unique numeric process ID assigned by Windows.
- CPU %: The percentage of total system CPU capacity the process is currently using.
- Memory: The process's current physical working set (RAM) usage.
- Threads: The number of threads currently running within the process.
- Handles: The number of open kernel object handles, such as files and registry keys, held by the process.
- Started: The date and time the process was launched.
- Priority: The process's CPU scheduling priority class.
- Disk I/O: The combined rate of disk read, write, and other I/O activity.
- Private Bytes: The amount of memory committed exclusively to the process.
- Page Faults: The rate of page faults per second, showing how often the process accesses memory outside its working set.
- User: The account under which the process is running.
- Command Line: The full command line, including arguments, the process was launched with.
- Architecture: Whether the process is running as x86, x64, or ARM64 code.
- Session: The Windows session ID the process belongs to.
- Peak Memory: The highest physical memory (working set) usage the process has reached.
- Virtual Memory: The total virtual address space reserved by the process.
- GDI Objects: The number of GDI graphics objects, such as brushes and pens, currently allocated by the process.
- USER Objects: The number of USER objects, such as windows and menus, currently allocated by the process.
- Integrity: The process's Windows integrity level, such as Low, Medium, High, or System.
- Parent PID: The process ID of the parent process that launched it.
- Private Working Set: The portion of physical memory used exclusively by this process, excluding memory shared with other processes.
- Paged Pool: The amount of pageable kernel memory allocated on the process's behalf.
- Non-paged Pool: The amount of non-pageable kernel memory allocated on the process's behalf.
- I/O Read: The rate of bytes read from disk or other I/O devices.
- I/O Write: The rate of bytes written to disk or other I/O devices.
- I/O Other: The rate of bytes transferred by I/O operations that are neither reads nor writes.
- Description: The file description recorded in the executable's version information.
- Company: The company name recorded in the executable's version information.
- DPI Awareness: How the process handles high-DPI displays: Unaware, System, or Per-Monitor.
- Service: The name of any Windows service or services hosted inside the process.
- GPU: The percentage of total GPU capacity the process is currently using, summed across all GPU engines.
- GPU Memory: The combined dedicated and shared GPU memory currently committed to the process.
- CPU Time: The total accumulated CPU time the process has consumed since it started.
- Elevated: Whether the process is running with administrator privileges.
- Path: The full file system path to the process's executable.
- Window Title: The title of the process's main visible window, if it has one.
- File Version: The file version recorded in the executable's version information.
- Product Version: The product version recorded in the executable's version information.
- Session Name: The friendly name of the Windows session the process belongs to, such as Console or Services.
- Package Name: The full package name for processes installed as a UWP or Store app, blank for regular Win32 processes.
- Peak Virtual Memory: The largest amount of virtual address space the process has reserved at any point since it started.
- Peak Private Bytes: The highest amount of memory the process has ever committed exclusively to itself.
- Peak Paged Pool: The highest amount of pageable kernel memory ever allocated on the process's behalf.
- Peak Non-paged Pool: The highest amount of non-pageable kernel memory ever allocated on the process's behalf.
- Peak Threads: The largest number of threads the process has had running at once since it started.
- Hard Faults: The rate of hard page faults per second, counting only the faults that had to be satisfied by reading from disk. Unlike Page Faults, this reflects real disk pressure.
- CPU Cycles: The rate at which the process is consuming CPU clock cycles. On processors with a mix of performance and efficiency cores, this is a more accurate measure of work done than CPU %.
- Kernel Time: The portion of the process's accumulated CPU time spent inside the Windows kernel, such as during system calls.
- User Time: The portion of the process's accumulated CPU time spent running its own code.
- Total Page Faults: The total number of page faults the process has taken since it started, as a running count rather than a rate.
- I/O Read Ops: The total number of read operations the process has issued since it started. A process moving few bytes across many operations behaves very differently from one moving the same bytes in a single read.
- I/O Write Ops: The total number of write operations the process has issued since it started.
- I/O Other Ops: The total number of I/O operations that are neither reads nor writes, such as device control requests.
- Total I/O: The total number of bytes the process has transferred across all reads, writes, and other I/O since it started.
- Elapsed Time: How long the process has been running, in days, hours, minutes, and seconds. This is wall clock time, unlike CPU Time, which counts only time spent actually executing.
- Shared Working Set: The portion of the process's physical memory that is shared with other processes, such as loaded system DLLs. Together with Private Working Set this accounts for the whole Memory figure.
- Parent Name: The executable name of the process that launched this one. Shows "(exited)" when the parent has already terminated.
- Private Bytes Delta: How much the process's committed memory has grown or shrunk since the last refresh. A process that climbs steadily here is leaking memory.
- Working Set Delta: How much the process's physical memory usage has grown or shrunk since the last refresh.
- Handle Delta: How many kernel handles the process has gained or released since the last refresh. Steady growth here indicates a handle leak.
- Thread Delta: How many threads the process has created or ended since the last refresh.
- Virtualization: Whether UAC file and registry virtualization is Enabled, Disabled, or Not allowed for the process. Virtualization silently redirects writes that older programs make to protected locations.
- AppContainer: Whether the process runs inside an AppContainer sandbox, as Store apps and many browser child processes do.
- Domain: The domain or authority that owns the process's account, such as your machine name, NT AUTHORITY, or an Active Directory domain. Use this alongside User to tell apart identically named accounts from different domains.
- User SID: The full security identifier of the process's account.
- Efficiency Mode: Whether the process is running under EcoQoS, where Windows deliberately runs it at a reduced clock speed to save power. This is the same state Task Manager marks with a leaf icon.
- I/O Priority: The priority Windows gives the process's disk requests, from Very Low to Critical. Background tasks such as indexing run at Very Low so they stay out of the way.
- Memory Priority: How readily Windows will trim the process's pages out of physical memory under pressure, from Idle to Normal.
- Protection: The process's protection level, such as WinTcb-Light or Antimalware-Light. Protected processes cannot be terminated or inspected even by an administrator, which is why some processes resist ending. Blank means the process is not protected.
Taskmon has robust support for customizing how data is displayed, built specifically with accessibility in mind.
- Settings: Press Ctrl+, and open the Columns tab. It holds two lists, one for the Processes tab and one for the Services tab. Check a column to show it, or clear it to hide it. To change the order, select a column and press Ctrl+Up or Ctrl+Down, or use that list's Move up and Move down buttons. Taskmon saves both lists between runs. Name always stays first in each.
- Drag and drop: You can drag column headers with the mouse to reorder them. Taskmon saves the result just as it does an order set from the Columns tab, and the accessible sort buttons follow along. Name cannot be dragged, because it always stays first.
- Accessible sorting: Screen reader users can press Tab from either list to focus a specialized set of hidden radio buttons. From there, use the Left and Right arrow keys to instantly change which column the list is sorted by. Pressing Enter will toggle the sort order between ascending and descending. The Services tab has its own set of these, covering its own columns.
Taskmon supports the following keyboard shortcuts for quick navigation and control:
- Ctrl+Shift+~: Global hotkey to toggle Taskmon visibility from anywhere.
- F5: Refresh the current tab manually.
- Ctrl+N: Open the Run dialog to start a new task.
- Ctrl+T: Toggle between the list and process tree views. Processes tab only.
- Ctrl+Tab: Move to the next tab. Ctrl+Shift+Tab moves to the previous one. In the Settings dialog these switch between the General and Columns tabs, as do Ctrl+Page Down and Ctrl+Page Up.
- Ctrl+F: Open the Find dialog to search the current tab.
- F3: Move to the next match. Shift+F3 moves to the previous one.
- Ctrl+,: Open the Settings dialog to customize columns and refresh rates.
- Delete: End the currently selected task.
- Escape: Hide Taskmon to the system tray.
- Ctrl+Q: Exit Taskmon completely.
Bringing up the context menu on a process in the list or tree view provides access to several actions:
- Open file location: Opens Windows Explorer to the directory containing the executable.
- Suspend or Resume: Pauses or resumes the execution of the process.
- End task: Forcefully terminates the process.
- End process tree: In the tree view only, terminates the selected process and all of its descendants, ending the children before their parents.
- Priority: Allows changing the CPU priority class (Idle, Below Normal, Normal, Above Normal, High, Realtime).
- Added Ctrl+Tab and Ctrl+Shift+Tab, as well as Ctrl+Page Down and Ctrl+Page Up, for switching between the General and Columns tabs in Settings.
- Fixed screen readers rereading the list of tray tooltip tokens every time focus entered the General tab in Settings. The list is now announced once, when you reach the System tray tooltip field.
- Fixed screen readers announcing an unnamed property page when tabbing into Settings. The pages are now announced as General and Columns.
- Fixed the Services tab, its sort buttons, and the tab strip keeping the old colors when Windows switched between light and dark mode.
- Added a tabbed interface. The process list now sits on a Processes tab, with a new Services tab beside it.
- Added a Services tab covering every Windows service, with Start, Stop, Restart, and Go to process actions, and its own columns that you can show, hide, and reorder from Settings.
- Added a Find dialog (Ctrl+F) for locating a process or service by name, with F3 and Shift+F3 to step through the matches.
- Added a customizable system tray tooltip, written as a template with tokens such as {cpu}, {mem} and {processes}, set on the General tab in Settings.
- Fixed the process tree not taking focus at startup when Taskmon was last closed in tree view, which left screen readers announcing the hidden process list instead.
- Fixed the system tray tooltip not updating while auto-refresh was set to Off.
- Added column reordering. The Settings dialog is now split into a General tab and a Columns tab, and on the Columns tab you can reorder columns with Ctrl+Up and Ctrl+Down or with the Move up and Move down buttons. Taskmon saves the order between runs.
- Fixed column header drag and drop being forgotten on restart, and leaving the accessible sort buttons in the old order.
- Fixed the Ctrl+Shift+~ hotkey doing nothing after using File > Restart as administrator.
- Fixed the installer not reflecting your earlier choices. Its checkboxes now show what is actually installed, and clearing one removes it.
- Fixed the installer not remembering a custom install location.
- Added 29 new columns: Peak Virtual Memory, Peak Private Bytes, Peak Paged Pool, Peak Non-paged Pool, Peak Threads, Hard Faults, CPU Cycles, Kernel Time, User Time, Total Page Faults, I/O Read Ops, I/O Write Ops, I/O Other Ops, Total I/O, Elapsed Time, Shared Working Set, Parent Name, Private Bytes Delta, Working Set Delta, Handle Delta, Thread Delta, Virtualization, AppContainer, Domain, User SID, Efficiency Mode, I/O Priority, Memory Priority, and Protection.
- Fixed observable lag when switching the sorting method with the keyboard.
- Fixed preferences being rewritten to disk on every sort-order change instead of only when needed.
- Fixed the process tree incorrectly nesting processes under recycled parent PIDs.
- Rewrote Taskmon from C to Zig.
- Switched the Windows installer from Inno Setup to NSIS, shrinking it by around 95%.
- Added Ctrl+Q as a shortcut to exit Taskmon completely.
- Added 11 new columns: Service, GPU, GPU Memory, CPU Time, Elevated, Path, Window Title, File Version, Product Version, Session Name, and Package Name.
- Added File > Restart as administrator to relaunch Taskmon elevated.
- Added a hierarchical Process Tree view (Ctrl+T) that groups processes under the parent that launched them, with an End process tree action that terminates a process and all of its descendants.
- Added an option to start Taskmon already minimized to the tray.
- Added a Windows installer alongside the existing portable version, with an option to replace the system Task Manager with Taskmon.
- Fixed a stack overflow that could occur when sorting by CPU usage.
- Fixed Ctrl+A not selecting all text in the Run dialog's edit box.
- Added support for ARM64 architecture.
- Releases are now packaged as ZIP files containing a standalone HTML user manual.
- Added 10 new columns: DPI Awareness, Company, Description, Parent PID, Private Working Set, Paged Pool, Nonpaged Pool, I/O Read, I/O Write, and I/O Other.
- Improved memory and I/O column formatting using standard Windows byte size strings.
- Added a basic status bar.
- Added a run dialog for launching new tasks.
- Added Always on Top and Remember Window Position options.
- Added 14 new columns: GDI objects, User objects, Integrity, Peak working set, Virtual memory size, Session, Architecture, User, Command line, Disk I/O, Private bytes, Page faults, Priority, and Process start time.
- Added the ability to suspend and resume processes.
- Added an option to change process priority.
- Fixed an issue where CPU usage showed 0% on first run.
- Fixed beep when pressing space after letter navigation in the settings column list.
- Removed duplicate error message when launching a program fails.
- Taskmon will now respect your system dark mode setting.
- Added an option to turn off the end task confirmation dialog.
- Added Ctrl+Shift+` as a global hotkey to toggle Taskmon's window from anywhere on your system.
- Column customization in the options dialog is now a proper list of checkboxes.
- Fixed the system tray icon showing incorrect memory usage statistics.
- Switched the end task key to Delete.
- The CPU percentage column now has a more human-friendly label.
- Various other small improvements, such as smartly selecting a process after one is killed and improved wording.
- Initial release.