Share via

Sysinternals - Process Monitor: How to exclude all currently running process?

DK_Choobs 0 Reputation points
2026-03-13T07:51:09.7+00:00

Sysinternals - Process Monitor

Background:
when you want to monitor something that happens but you do not know the process name or process id or if the action spawns additional process, I open process monitor and manually right click "exclude '%Process Name%' " for every process until the Output is empty then i run the action that I want to investigate and review the output.
This does the Job but now a days with windows having hundreds of process this takes ages every time...
I checked all the menus and could not find any thing.

Question:
Is there an easy button exclude all currently running process names?
Or a way to use the export "process activity summary" to csv clean it up and import it manually as a filter list where 'ProcessName" is CSV action exclude?

Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 82,685 Reputation points MVP Volunteer Moderator
    2026-03-13T11:15:40.0766667+00:00

    AFAIK, Process Monitor does not have a single button to exclude all currently running processes. You can work around it by manipulating the registry where the filters are stored or by creating a custom configuration file. ProcMon stores its filter rules in the Windows Registry under the key HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor. Each filter is a binary structure, which makes manual CSV-to-Filter conversion difficult without a helper script.

    One way to handle this is to use a PowerShell script to gather all unique, currently running process names and generate a Process Monitor Configuration file or modify the registry directly. A simpler manual approach is to use the Include filter logic. Instead of excluding what is running, you can create a filter for the attribute Process Name is not empty and then use the Drop Filtered Events option under the Filter menu. This ensures that only new activity is captured once you begin your specific action.

    If you prefer the exclusion method, you can use the following PowerShell command to copy all current process names to your clipboard, formatted as a list that you can quickly reference, though ProcMon still requires these to be added to the filter dialog one by one unless you use a configuration injector.

    Get-Process | Select-Object -ExpandProperty Name -Unique | Set-Clipboard

    Another workaround is to use the Time of Day filter. Before you run your action, note the current system time down to the second. Open the Filter dialog (Ctrl+L) and add a rule where Time of Day is after your noted time, then set the action to Include. This should hide every process event that occurred before your test began, effectively giving you a clean slate without needing to name every individual background process.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.