What’s this Program Running on My Machine?

So. Many. Programs.

As you use your Windows machine there will bemany programs running. Some you’ll see and some running in the background.

My primary desktop has 406 running as I update this article. And yes, that’s a lot. The Windows 11 virtual machine I use for examples has only ~150.

“Only.”

What the heck are all those programs running on my machine?

Programs running on your machine

Windows runs many visible and hidden programs, often creating multiple processes. You can use Task Manager, Process Explorer, or tasklist to see what’s running. Having many processes, as well as multiple instances of processes, is quite normal. Do be cautious when researching, as some search results will try to scare you unnecessarily.

Processes or Programs?

First, a little terminology. The terms program and process are sometimes used interchangeably, but they’re not quite the same.

Edge, or Word, or Thunderbird are all what you and I would call programs. They’re what we see and what we run. These are also often called “Apps” or “Applications”.

Windows really only sees what it calls processes. The difference is that a single program may (or may not) cause several separate processes to be run. Edge is a great example: running a single copy of Edge on my example machine causes 40 processes to be run. This isn’t a bad thing or a good thing, it’s simply how the software has been architected to divvy up its work.

Throughout this article we’ll be looking at processes. In most cases — like the 40 Edge processes I have — it’ll be obvious what program they relate to. In some cases not, and I’ll try to explain those as well.

Getting the list

There are three ways to get the list of currently running processes.

Task Manager

Right click on an empty area in the task bar, and click on Task Manager. Once open, click on  the Processes tab.

This view has the advantage of showing you “Apps”, the programs you probably recognize as having run. “Background processes” are just that, processes you don’t see performing some kind of work in the background.

Processes are grouped. For example, you’ll see Google Drive shows “(9)”, meaning it has nine processes associated with it. Click on the “>” to expand the list.

Right click on any of those items and click Properties to see the details of the specific process.

You can also use the “Details” tab in Task Manager to get list that includes more details, but without the process grouping.

Process Explorer

Task Manager has improved over the years, but I still prefer using Process Explorer, part of the SysInternals Suite in the Microsoft Store. It’s interface feels more useful, and lets you view both details and process organization at the same time.

One of the more compelling features of Process Explorer is the tree view that lets you see which process is responsible for running which sub-process. For example above you can see:

winnt.exe started services.exe which started svchost.exe which started SearchHost.exe and StartMenuExperienceHost.exe, and so on.

Like Task Manager, you can right click on any process and click Properties to get even more detail.

Tasklist

Tasklist is a command-line utility similar to Task Manager and Process Explorer.

“Tasklist /?” will list a number of additional options beyond the default alphabetical list. Tasklist is useful if you want to make use of some of those options, or if you want to save the results in a text file.

Related

Why Ask Why?

It's common to ask "Why?" when it comes to computers. It's also common to be frustrated with the answer.

Why so many?

Now that we’ve seen the lengthy list of processes running on your machine, just why are there so many?

To begin with, note that your list will be different than mine. In fact it’s extremely unlikely that any two machines will be identical.

My main machine with 460 processes is different than my example machine simply because I’ve installed and am running significantly more software. On top of that, as we’ve seen with Edge, your browser may start multiple different processes simply by virtue of the websites you visit, or the tabs you have open.

The number of processes running on your machine will depend on a number of factors:

• How much software you’re explicitly choosing to run, such as when you fire up your email program, word processor, browser or others.
• The software you have installed on your machine that relies on processes running all the time. In my example above you can see Google Drive is present, because its synchronization utility needs to run all the time to do the job we’re asking of it.
• The software you have installed on your machine that auto-starts. Even if you’re not “running” a particular program, many will still have processes installed and running automatically when you sign in.
• The hardware you have installed on your machine. Some devices will include processes that are required to support the hardware.

And probably more things. Windows is a complex operating system.

So, what are they?

Some will be fairly obvious based on their name. “Google Drive”, or “GoogleDriveFS.exe”, are clearly the Google Drive application I have installed.

“cmd.exe” is the “Command Prompt”. “WindowsTerminal.exe” is the Windows terminal. “powershell.exe” is Power Shell.

But CSRSS? LSASS? SVCHOST? For these and many of the others we don’t immediately recognize we need to look a little deeper.

Process explorer’s tree view will start to uncover clues. For example that one process started another might indicate that they’re related. Process explorer also includes a description column that often, though not always (it’s up to the application author) offers more information.

Process explorer also includes a search. Right click on any process, and click on the Search Online… item. My only caution here is that the search is performed using your default search engine. There are often less-than-reputable search results that try to scare you into thinking something is malicious when it’s not. Never take action based solely on a single search. If you’re intent on diagnosing a problem, or learning more, spend some time to research on known reputable sites like Microsoft’s own.

The steps above can identify most process, at least to the point of understanding what application they belong to or whether they are part of the operating system.

One process deserves special note: “svchost”. What Is Svchost, and Why Is There More Than One Copy Running? goes into more detail, but it’s not uncommon for there to be many instances of that process running. Of the 460 processes on my machine, 94 of them are svchost. It’s one of Windows’ workhorse processes.