How do I see what arguments with which a running program was launched in an external cmd prompt?

Question

I have a program in Windows 7 that launches ffmpeg in an external command prompt window but it is impossible to see what arguments were passed in.

Is there a way to see what arguments were given?

score 1 · Accepted Answer · answered Jan 07 '16 at 20:36

ProcessHacker (a Task Manager replacement) will display the command line arguments for any selected process:

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.

Example:

F:\test>cmd /c test.cmd

F:\test>echo off
Press any key to continue . . .

In ProcessHacker:

Select the process you are interested in.

There may be several cmd shell processes running and you will have to make sure you select the correct one. Hovering over the process name will show the command line so you know the correct one to select:
Right click and select "Properties" or just press Enter.
The resulting "Properties" dialog shows the command line used to start the process.

I am not affiliated with ProcessHacker in any way, I am just an end user of the software.

Clayton · Answer 2 · 2016-01-08T14:11:13.743

Edit local policy and enable "Audit Process Tracking" (secpol.msc)
Install KB3004375 and reboot https://support.microsoft.com/en-us/kb/3004375
Enable Audit Process Creation/Include CLI (gpedit.msc)
If you're using Win7 Home instead of professional you won't have gpedit.msc. Regedit to HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit. Set key ProcessCreationIncludeCmdLine_Enabled = 1
Run the program that launches FFMEG
Review the security event log for event ID 4688

2 Answers2