How can I tell which "explorer.exe" process is the main one?

Question

I have a batch file that changes a few registry files, and then restarts explorer.exe so that they take effect. I'm using the commands

taskkill /f /im explorer.exe
explorer.exe

This of course kills all the explorer.exe processes, including the explorer windows I have open. (Obviously, I am using the option to Launch folder windows in a separate process.)

Is there any way I can determine which instance of explorer.exe is the main one, and just kill that?

Answer 1

Window title based approach

@techie007 suggested killing the explorer.exe with window title N/A.

Command

for /f "tokens=2,10" %%p in ('tasklist /nh /v /fi "imagename eq explorer.exe"') do if "%%q"=="N/A" taskkill /f /pid %%p

How it works

• tasklist /nh /v /fi "imagename eq explorer.exe" verbosely lists all processes with image name explorer.exe.

• for /f "tokens=2,10" %%p in ('COMMAND1') do COMMAND2

  executes COMMAND1. For each line of output, it sets the variables %%p and %%q to the second and tenth "token" (delimited by space) and executes COMMAND2.

  In the case of taskkill /v, %%p now holds the PID and %%q the (beginning of) the window title.

• if "%%q"=="N/A" taskkill /f /pid %%p checks if the window title is N/A.

  If so, it terminates the process with taskkill.

Memory usage based approach

@Syntech pointed out that this is unreliable for Windows Explorer, but in programs, the main process has always the highest memory usage.

Command

for /f "tokens=2" %%p in ('tasklist /nh /fi "imagename eq explorer.exe" ^| sort /+65') do @set explorerpid=%%p
taskkill /f /pid %explorerpid%

How it works

• tasklist /nh /fi "imagename eq explorer.exe" lists all processes with image name explorer.exe.

• sort /+65 sorts the previous output starting with the 65th character (where mem usage begins).

• for /f "tokens=2" %%p in ('COMMAND') do @set explorerpid=%%p sets explorerpid to the second (tokens=2) input – delimited by spaces – of each line of the output of COMMAND, which is the corresponding PID.

• Since tasklist's ouput has been sorted, explorerpid holds the claimed PID, and taskkill terminates the process.

Answer 2

Perhaps you can tell Explorer to show the path in the title bar, and then use the WINDOWTITLE filter to kill it based on that?

• Open Explorer
• Press Alt
• Click on "Tools (menu item)"
• Click on "Folder options... (menu item)"
• Click on "View (page tab)" in "Folder Options"
• Click to select "Display the full path in the title bar (Classic theme only)" in "Folder Options"
• Click on "Apply" -> "OK"

The path won't show in Explorer's title bar with the 'non-classic' themes, but it is (now) there; it's just not visible.

taskkill /F /FI "WINDOWTITLE eq C:\PathToThing\RunningInExplorer\ToRestart*"

You may need to switch to a classic theme temporarily to determine what the path/title is for the Explorer instance you want to restart.

Not 100% fool-proof, but any Explorer windows that don't have that (partial) path in the title would be safe at least. :)

edit:

Since you want to grab the one with title "N/A", you'll probably have to use a batch file so that you can tokenize the results of a TASKLIST adn tehn use those token results to use TASKKIL to kill by PID.

I found an answer over to StackOverflow.com that addresses this:

From question Taskkill an untitled process? is this answer which includes this example batch file:

@echo off
SETLOCAL enabledelayedexpansion
for /f "tokens=*" %%a in ('TASKLIST /V') do (
  set s=%%a
  set p=!s:~27,5!
  set t=!s:~152,3!
  if '!t!'=='N/A' ECHO TASKKILL /PID !p! /T
)

You'll want to change the 'TASKLIST /V' command to be more specific to Explorer.exe and such, but it should give yo a good starting point.

Answer 3

Kill the process with the lowest PID (Process ID). It would have been started first, as processes get numbered sequentially.