Tasklist seems to show strange results when using /FI CPUTIME ge and gt. Below are some examples:
tasklist /fi "imagename eq tsadmin.exe" /v
Image Name PID Session Name Session# Mem Usage Status User Name CPU Time
========================= ======== ================ =========== ============ =============== =================================================== ============
tsadmin.exe 3668 RDP-Tcp#1 1 6,532 K Unknown DOMAIN\user1 0:22:45
tsadmin.exe 6080 RDP-Tcp#6 0 6,808 K Running DOMAIN\user2 0:37:29
tsadmin.exe 6136 RDP-Tcp#28 3 3,148 K Unknown DOMAIN\user3 0:15:35
tsadmin.exe 6052 RDP-Tcp#6 0 5,180 K Running DOMAIN\user2 0:00:00
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime gt 00:01:00" /v
INFO: No tasks are running which match the specified criteria.
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime gt 00:05:00" /v
INFO: No tasks are running which match the specified criteria.
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime gt 00:10:00" /v
INFO: No tasks are running which match the specified criteria.
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime ge 00:01:00" /v
Image Name PID Session Name Session# Mem Usage Status User Name CPU Time
========================= ======== ================ =========== ============ =============== =================================================== ============
tsadmin.exe 3668 RDP-Tcp#1 1 6,532 K Unknown DOMAIN\user1 0:22:46
tsadmin.exe 6080 RDP-Tcp#6 0 6,808 K Running DOMAIN\user2 0:37:30
tsadmin.exe 6136 RDP-Tcp#28 3 3,148 K Unknown DOMAIN\user3 0:15:36
tsadmin.exe 6052 RDP-Tcp#6 0 5,180 K Running DOMAIN\user2 0:00:00
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime ge 00:05:00" /v
Image Name PID Session Name Session# Mem Usage Status User Name CPU Time
========================= ======== ================ =========== ============ =============== =================================================== ============
tsadmin.exe 3668 RDP-Tcp#1 1 6,532 K Unknown DOMAIN\user1 0:22:46
tsadmin.exe 6080 RDP-Tcp#6 0 6,808 K Running DOMAIN\user2 0:37:30
tsadmin.exe 6136 RDP-Tcp#28 3 3,148 K Unknown DOMAIN\user3 0:15:35
tsadmin.exe 6052 RDP-Tcp#6 0 5,180 K Running DOMAIN\user2 0:00:00
tasklist /fi "imagename eq tsadmin.exe" /fi "cputime ge 00:10:00" /v
INFO: No tasks are running which match the specified criteria.
When using the gt option, no tasks appear. When using the ge option, the result doesn't match what the input filter is. This is resolved (at least for me) by using a powershell scriptlet.
Get-Process tsadmin | where { $_.CPU -gt 300 }
This produces the correct output of process with long cputimes. You can then run this one to end them:
Get-Process tsadmin | where { $_.CPU -gt 300 } | Stop-Process
