How can I tell which "explorer.exe" process is the main one?

Question

I have a batch file that changes a few registry files, and then restarts explorer.exe so that they take effect. I'm using the commands

taskkill /f /im explorer.exe
explorer.exe

This of course kills all the explorer.exe processes, including the explorer windows I have open. (Obviously, I am using the option to Launch folder windows in a separate process.)

Is there any way I can determine which instance of explorer.exe is the main one, and just kill that?

Solution 1

Window title based approach

@techie007 suggested killing the explorer.exe with window title N/A.

Command

for /f "tokens=2,10" %%p in ('tasklist /nh /v /fi "imagename eq explorer.exe"') do if "%%q"=="N/A" taskkill /f /pid %%p

How it works

• tasklist /nh /v /fi "imagename eq explorer.exe" verbosely lists all processes with image name explorer.exe.

• for /f "tokens=2,10" %%p in ('COMMAND1') do COMMAND2

  executes COMMAND1. For each line of output, it sets the variables %%p and %%q to the second and tenth "token" (delimited by space) and executes COMMAND2.

  In the case of taskkill /v, %%p now holds the PID and %%q the (beginning of) the window title.

• if "%%q"=="N/A" taskkill /f /pid %%p checks if the window title is N/A.

  If so, it terminates the process with taskkill.

Memory usage based approach

@Syntech pointed out that this is unreliable for Windows Explorer, but in programs, the main process has always the highest memory usage.

Command

for /f "tokens=2" %%p in ('tasklist /nh /fi "imagename eq explorer.exe" ^| sort /+65') do @set explorerpid=%%p
taskkill /f /pid %explorerpid%

How it works

• tasklist /nh /fi "imagename eq explorer.exe" lists all processes with image name explorer.exe.

• sort /+65 sorts the previous output starting with the 65th character (where mem usage begins).

• for /f "tokens=2" %%p in ('COMMAND') do @set explorerpid=%%p sets explorerpid to the second (tokens=2) input – delimited by spaces – of each line of the output of COMMAND, which is the corresponding PID.

• Since tasklist's ouput has been sorted, explorerpid holds the claimed PID, and taskkill terminates the process.

Solution 2

Perhaps you can tell Explorer to show the path in the title bar, and then use the WINDOWTITLE filter to kill it based on that?

• Open Explorer
• Press Alt
• Click on "Tools (menu item)"
• Click on "Folder options... (menu item)"
• Click on "View (page tab)" in "Folder Options"
• Click to select "Display the full path in the title bar (Classic theme only)" in "Folder Options"
• Click on "Apply" -> "OK"

The path won't show in Explorer's title bar with the 'non-classic' themes, but it is (now) there; it's just not visible.

taskkill /F /FI "WINDOWTITLE eq C:\PathToThing\RunningInExplorer\ToRestart*"

You may need to switch to a classic theme temporarily to determine what the path/title is for the Explorer instance you want to restart.

Not 100% fool-proof, but any Explorer windows that don't have that (partial) path in the title would be safe at least. :)

edit:

Since you want to grab the one with title "N/A", you'll probably have to use a batch file so that you can tokenize the results of a TASKLIST adn tehn use those token results to use TASKKIL to kill by PID.

I found an answer over to StackOverflow.com that addresses this:

From question Taskkill an untitled process? is this answer which includes this example batch file:

@echo off
SETLOCAL enabledelayedexpansion
for /f "tokens=*" %%a in ('TASKLIST /V') do (
  set s=%%a
  set p=!s:~27,5!
  set t=!s:~152,3!
  if '!t!'=='N/A' ECHO TASKKILL /PID !p! /T
)

You'll want to change the 'TASKLIST /V' command to be more specific to Explorer.exe and such, but it should give yo a good starting point.

Solution 3

Kill the process with the lowest PID (Process ID). It would have been started first, as processes get numbered sequentially.

Comments

[Admin]

Killing the main explorer.exe will probably just kill all of the others since they depend on it to run.

[Admin]

@ekaj It does not. I am able to do it manually. Each window is an independent process.

[Admin]

I’m interested in finding a reliable way to determine the primary (associated with the Desktop) explorer.exe instance as well, but for the opposite reason. I find it annoying that spawned explorer.exe processes are not always exited when all of their associated windows are closed. I use the Task Manager to kill them, and tend to rely on the fact that the spawned instances are usually set to high priority (for some reason). This works fine, but if I happen to have set it to normal (for obvious reasons), then I run the risk of accidentally kill the primary process.

[Admin]

@Synetech The solution to that is taskkill /f /im explorer.exe /fi "windowtitle ne N/A". For some reason, copy/pasting that into the cmd prompt doesn't work; you have to type it by hand. Didn't try a batch file.

[Admin]

You have split the problem into an easy and an impossible part, solved the easy part and are now asking for help with the impossible part. It is quite likely that the "easy" part of the solution is not correct (e.g. what you are trying to do could be achieved with a group policy), so it would be nice if your question included the original problem you are trying to solve. Killing processes that do not belong to you is seldom correct.

[Hod - Monica's Army]

+1 This would work for the first time the batch file is run, but since explorer.exe is restarted, the new "main" process will have a higher PID. Is there another way?

[Mythrillic]

This is true. However you could just output tasklist | find /f "explorer" and ask then just ask (with user input) what is the lowest PID to kill.

[Dennis]

@HodofHod: The most reliable way would be to select the process with the highest memory usage. If you can use MinGW (sed, awk, etc.), that pretty easy to do automatically. If not, user input might be the best choice.

[Hod - Monica's Army]

The process I want to kill is the main one. tasklist /fi "imagename eq explorer.exe" /v /fo list tells me that its windowtitle is "N/A". Unfortunately, `"windowtitle eq N/A" doesn't work. Any ideas?

[Hod - Monica's Army]

Thank you! But for some reason this isn't working for me, yet. I'm working to see if I can modify it somehow to make it work.

[Ƭᴇcʜιᴇ007]

Ahhhhhh. gotcha. I found an answer to that on StackOverflow, I'll update the answer with the relevant bits here with a link.

[Synetech]

@Dennis, > to set explorerpid to the PID of the explorer.exe with the highest memory usage. That should be the most reliable way to determine the main process. Nope not correct. Open a new window process (e.g., via a shortcut), and navigate to a folder with lots of pictures and view them in thumbnail mode. The new process will quickly overtake the original one in memory usage. > Well, you didn't mention that you're not using the default configuration. The question is How can I tell which "explorer.exe" process is the main one? How else do you think that could be an issue?

[Synetech]

I still don’t see how this would work. What if there are no open Explorer windows other than the desktop?

[Synetech]

@Adam543i, >Kill the process with the lowest PID (Process ID). It would have been started first, as processes get numbered sequentially. What version of Windows are you talking about? This simply is not true. Aside from the random PID security function, I recall something on OldNewThing about PIDs being assigned in intervals (of four or 16 or something). The fact is, that using PIDs (even relative ones) is just too unreliable.

[Synetech]

@Dennis, > The most reliable way would be to select the process with the highest memory usage. Nope. Not at all. It is extremely easy for a spawned process to have a higher memory usage.

[Dennis]

@Synetech: I was thinking with the (false) assumption that the memory usage was shared. For example, the main Chrome process has always the highest memory usage.

[Hod - Monica's Army]

Both the windowed approach and the memory approach now work. I think I'll go with windowed - seems more reliable. Thanks very much!

[Synetech]

@Dennis, I'm not sure even that is necessarily true. I have not done a test (yet), but I would not be surprised if opening a page with lots of JavaScript, images, and such would be able to increase the usage of a spawned process than the main browser (especially if the browser were just recently opened). Oh man! Now I'm really tempted to do a test. :-P

[Dennis]

@Synetech: I tried with a JavaScript implementation of the Burrows-Wheeler Transform I wrote once. You're right: The child process's mem usage can outgrow the main process's.