Windows Server

Task Kill Vs Stop Process: How to forcefully kill or stop a process in Windows

PID (Process ID) is a short form for process identifier. A PID is a unique number that identifies each running process in an operating system, such as Linux, Unix, macOS, and Microsoft Windows. Task Killer can help you to kill (close or stop) the running apps of your device by ending one or more tasks or processes. Processes can be ended by PID or image name and Taskkill has replaced the kill tool.

Note: In order to kill a process via the Command Prompt or PowerShell, you need an Administrator (elevated) privilege.

As an Administrator from time to time, you may need to kill a service which is problematic and stuck or start a service that has refused to start.
- Killing a service that is stuck or has refused to start will save you the time of restarting or rebooting a Server.

To have this done, you will need to search for the PID of the service. To determine the name of a service, this can be found in the following ways.
– From the “services.msc” window (Also from the Task Manager, You can also access the services tab).
– To determine the service PID, I will be using the “sc queryex” command to query the service name of the application.
– Also, launch Command Prompt with Administrators privilege and run tasklist to see all of the running processes.

Note: Since the list might be very long, you can use a pipe character with more command as shown below

tasklist | more

How (steps) for querying a service name
– Launch an elevated Command Prompt (CMD): use the following command below with the service name from the command prompt.

sc queryex servicename

Kill a service: To kill a service, launch the command prompt, the PID is paramount as this will be used to kill the service. See the images above on how to obtain the process ID (PID).
– Launch an elevated Command Prompt and
– Type the following command below to kill the service

taskkill /f /pid [PID]

Where [PID] is the value associated the service name as shown above.

Note: The /f flag is used to kill the process forcefully. Failure to use the /F flag will result in nothing happening in some cases

Alternatively, we can also use the Task Manager to kill a service. For more information on using the Task Manager, see https://techdirectarchive.com/2020/04/24/how-to-launch-windows-task-manager/

Note: Ensure absolute care is taken on what service you are killing though. If you kill a critical windows service you may end up forcing the machine to reboot on its own in order to have this it resolved.

Below are other filtering options variables and operators that can be used with “taskkill”.

VariablesOperators
STATUSeq (equals)
IMAGENAMEne (not equal)
PIDgt (greater than)
SESSIONlt (less than)
CPUTIMEge (greater than or equal)
MEMUSAGEle (less than or equal)
MODULES
Services
WINDOWSTITLE

These variables and operators can be used with the /FI filtering flag. 
Example 1: You wish to end all processes that has a window title that starts with “DriveBit”:

taskkill /FI "WINDOWTITLE eq DriveBit*" /F

– Example 2: Kill all the process running under a user account

taskkill /FI "USERNAME eq Administrator" /F

– Example 3: Kill a service running on a remote desktop (server)

taskkill /S AnsibleServer /U RemoteAccountName /P RemoteAccountPassword /IM chrome.exe /F

For other similar tools that can be used in place of Task Manager, see the the following articles. For Process Explorer (SysInternal Tools), see https://techdirectarchive.com/2020/03/07/process-explorer/
– How to use SysInternals Live Tools, see https://techdirectarchive.com/2020/02/09/how-to-use-sysinternals-live-tools/
– How to download and use Windows SysInternals tools locally, see https://techdirectarchive.com/2020/01/25/windows-sysinternals-tools-psexec-and-auto-logon/
– Process Explorer (Replace built-in Task Manager) https://techdirectarchive.com/2020/03/08/process-explorer-replace-built-in-task-manager/

Via PowerShell: Killing a process via PowerShell is somewhat similar to killing a process using CMD.
– You also need elevated (Admin rights) to have this done.

Launch PowerShell as an Administrator
– Type the command Get-Process to see the list of running processes as shown below

Get-Process

1: To kill a process by its name: Execute the following cmdlet as shown below.

- Stop-Process -Name "ProcessName" -Force

To kill a process by its PID, run the command as shown below.

Stop-Process -ID PID -Force

I hope you found this blog post helpful. If you have any questions, please let me know in the comment session.

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x