What’s This Program Running on My Machine?

So. Many. Programs.

There are always many programs running on a Windows device. Some you see, and others run in the background.

My primary desktop has 406 programs running as I update this article. And yes, that’s a lot. The Windows 11 virtual machine I use only has around 150.

Only.

What the heck are all those programs running on my machine?

Programs running on your machine

Windows runs both visible and hidden programs, often creating multiple processes. You can use Task Manager, Process Explorer, or Tasklist to see what’s running. Having many processes and multiple instances of processes is quite normal. Be cautious when researching, as some search results will try to scare you unnecessarily.

Processes or Programs?

First, a little terminology. The terms program and process are sometimes used interchangeably but are not quite the same.

Edge, Word, or Thunderbird are all what you and I would call programs. We start them up and interact with them. These are also often called apps or applications.

Windows only sees what it calls processes. The difference is that a single program may (or may not) cause several separate processes to be run. Edge is a great example. Running a single copy of the web browser Edge on my example machine causes 40 processes to be run. This isn’t a bad thing or a good thing; it’s simply how the software has been written to divvy up its work.

Throughout this article, we’ll be looking at processes. In most cases — like the 40 Edge processes I have going — it’ll be obvious what program they relate to. In some cases, it is not, and I’ll try to explain those as well.

Getting the list

There are three ways to get a list of currently running processes: Task Manager, Process Explorer, or Tasklist.

Task Manager

Right-click on an empty area in the taskbar and click on Task Manager. Once open, click on the Processes tab.

This view has the advantage of showing you apps — the programs you probably recognize as having run. “Background processes” are just that: processes you don’t see and didn’t start that are performing some work in the background.

Processes are grouped. For example, you’ll see Google Drive shows “(9)”, meaning it has nine processes associated with it. Click on the “>” to expand the list.

Right-click on any of those items and click Properties to see the details of the specific process.

You can also use the “Details” tab in Task Manager to get more details but without the process grouping.

Process Explorer

Task Manager has improved over the years, but I still prefer using Process Explorer, part of the SysInternals Suite in the Microsoft Store. Its interface feels more useful and lets you view details and process organization at the same time.

One of the more compelling features of Process Explorer is the tree view, which lets you see which process is responsible for running which sub-process. In the example above, you can see:

winnt.exe started services.exe which started svchost.exe which started SearchHost.exe and StartMenuExperienceHost.exe, and so on.

Like Task Manager, you can right-click on any process and click Properties to get even more details.

Tasklist

Tasklist is a command-line utility similar to Task Manager and Process Explorer.

“Tasklist /?” lists a number of additional options beyond the default alphabetical list. Tasklist is useful if you want to make use of some of those options or if you want to save the results in a text file.

Related

Why Ask Why?

It's common to ask "Why?" when it comes to computers. It's also common to be frustrated with the answer.

Why so many?

Now we’ve seen the lengthy list of processes running on your machine, but we haven’t answered why are there so many.

To begin with, note that your list will be different than mine. In fact, it’s extremely unlikely that any two machines will be identical.

My main machine, with 460 processes running, is different than my example machine simply because I’ve installed and am running significantly more software on it. On top of that, as we’ve seen with Edge, your browser may start multiple different processes simply by virtue of the websites you visit or the tabs you have open.

The number of processes running on your machine depends on a number of factors, including:

• How much software you run, such as your email program, word processor, browser, or others.
• The software you have installed on your machine that relies on processes running all the time. In my example above, you can see Google Drive is present because its synchronization utility needs to run all the time to do its job.
• The software you have installed on your machine that auto-starts. Even if you’re not “running” a particular program, many still have processes installed and run automatically when you sign in.
• The hardware on your machine. Some devices include processes that are required to support the hardware.

And probably more things. Windows is a complex operating system.

So what are they?

Some processes are fairly easily identified based on their name. “Google Drive”, or “GoogleDriveFS.exe”, clearly belong to the Google Drive application I have installed.

“cmd.exe” is the Command Prompt. “WindowsTerminal.exe” is the Windows terminal. “powershell.exe” is Power Shell.

But CSRSS? LSASS? SVCHOST? For these and many others we don’t immediately recognize, we need to look a little deeper.

Process Explorer’s tree view helps uncover clues. For example, that one process started another might indicate that they’re related. Process Explorer also includes a description column that often, though not always (it’s up to the application author) offers more information.

Process Explorer also includes a search. Right-click on any process and click on the Search Online… item. My only caution here is that the search is performed using your default search engine. There are often less-than-reputable search results that try to scare you into thinking something is wrong or malicious when it’s not. Never take action based solely on a single search. If you’re intent on diagnosing a problem or learning more, spend some time researching on known reputable sites like Microsoft.com.

The steps above can identify most processes, at least to the point of understanding which application they belong to or whether they are part of the operating system.

One process deserves special note: “svchost”. What Is Svchost, and Why Is There More Than One Copy Running? goes into more detail. It’s not uncommon for there to be many instances of that process running. Of the 460 currently-running processes on my machine, 94 of them are svchost. It’s one of Windows’ workhorse processes.