Really killing a process in Windows
Asked Answered
B

11

406

Occasionally a program on a Windows machine goes crazy and just hangs. So I'll call up the task manager and hit the "End Process" button for it. However, this doesn't always work; if I try it enough times then it'll usually die eventually, but I'd really like to be able to just kill it immediately. On Linux I could just kill -9 to guarantee that a process will die.

This also could be used for writing batch scripts and writing batch scripts is programming.

Is there some program or command that comes with Windows that will always kill a process? A free third-party app would be fine, although I'd prefer to be able to do this on machines I sit down at for the first time.

Biforked answered 8/9, 2008 at 15:48 Comment(8)
Stray processes is a common enough problem in programming that I have to disagree; this is not an off-topic question.Billibilliard
I deal with process management every day as a developer. This is totally ON topic for me!Obduliaobdurate
I strongly advise against deleting this question. +195 and it's a really early google hit for the question involved.Longo
"unless they directly involve tools used primarily for programming" I ran into this issue in regards to Visual Studio keeping a process running which made me unable to kill it. Closing Visual Studio helped kill the problematic process.Glyndaglynias
You can use the Stop-Process powershell cmdlet.Knobloch
Aaaaaaaaaand it's closed :/Ablution
If another program has a reference to the process handle the program won't exit until released. It's known as a zombie program - there is nothing left in the program. If it was to exit it would cause the other program to crash.Cynicism
Kill a process with a known name, PID or wildcard pattern: https://mcmap.net/q/87593/-how-do-i-kill-a-processes-running-a-given-executableBitty
E
334

"End Process" on the Processes-Tab calls TerminateProcess which is the most ultimate way Windows knows to kill a process.

If it doesn't go away, it's currently locked waiting on some kernel resource (probably a buggy driver) and there is nothing (short of a reboot) you could do to make the process go away.

Have a look at this blog-entry from wayback when: http://blogs.technet.com/markrussinovich/archive/2005/08/17/unkillable-processes.aspx

Unix based systems like Linux also have that problem where processes could survive a kill -9 if they are in what's known as "Uninterruptible sleep" (shown by top and ps as state D) at which point the processes sleep so well that they can't process incoming signals (which is what kill does - sending signals).

Normally, Uninterruptible sleep should not last long, but as under Windows, broken drivers or broken userpace programs (vfork without exec) can end up sleeping in D forever.

Evanevander answered 8/9, 2008 at 15:52 Comment(17)
While I hate that this is the correct answer, there's no doubt in my mind that it is more correct than taskkill below.... stupid buggy drivers!Scientistic
Slighly less annoying than a reboot is to log off/on again. Still lose work, but not quite so much time perhaps.Ashes
Apparently this is not the "most ultimate way" to kill a process. There are some processes in Windows where after you destroy them with Task Manager they just instantly respawn as if nothing happened... :/Marylandmarylee
that's caused by some other process making sure the initial process is always running. You killed your old instance and a new one has been started by the watchdogEvanevander
How can I know what is making this process go into uninterruptible sleep?Trilobate
This answer is not correct at all. "End Process" is not the most ultimate way to kill processes, as it can't kill service processes (for example). taskkill /f is the most ultimate.Kurd
This should not be the accepted answer. The equivalent of Linux's "kill -9" command is the command "TaskKill /f". Obviously it needs to be run in an elevated command prompt.Splotch
TaskKill /f only calls the TerminateProcess API. It does exactly the same thing as the Task Manager (though, you're right on that, with elevated privileges).Evanevander
Using Task Manager alone to try to kill a process is equivalent to calling TaskKill without the /f option.Splotch
@colacX it's an error not a feature. It's stuck waiting for a signal so it can't hear any signals to end.Phosphate
In Windows 8, Task Manager no longer has the "End Process" button. It only has the "End Task" button, which attempts to terminate a process in a much gentler way.Interaction
@ThrowawayAccount3Million No, it just hides it better - you'll find the old list of processes with the familiar TerminateProcess-calling button on the Details tab :)Flyweight
I had success just now killing an unkillable java.exe process, using the info here that it might be waiting on a device driver. I disconnected the serial connection that I knew it was listening to, and the process died immediately.Zygospore
A cached version of the dead link: web.archive.org/web/20090530042534id_/http://blogs.technet.com/…Pfeiffer
In my case an instance of the Tomcat server won't shut down. Neither with 'End Process' nor with taskkill or the process explorer. I've used admin rights for all the cases, but the message 'Access denied' appears. This is hardly a driver problem. Any ideas how this can be analyzed or how the root cause can be found out?Kailyard
@Kailyard Isn't Tomcat running as a service? Why not just stop the service then?Mesopause
@TheincredibleJan It is running as a service. But sometimes Windows is not able to stop a service. That can happen if Tomcat has run out of memory. Then it takes either very long (many hours!) until the process is stopped or the server needs to be restarted. What cannot be done at any time on a production server.Kailyard
M
265
taskkill /im myprocess.exe /f

The "/f" is for "force". If you know the PID, then you can specify that, as in:

taskkill /pid 1234 /f

Lots of other options are possible, just type taskkill /? for all of them. The "/t" option kills a process and any child processes; that may be useful to you.

Midlothian answered 8/9, 2008 at 15:49 Comment(15)
Just a note. This is particularly useful if you are writing scripts for server management. kill.exe (from the NT Res kit) will cause a program to exit, but if you have a crash handler installed (particularly windbg), it can cause issues as the OS will see the killed process as having crashed, and attempt to debug it. Taskkill will not result in this issue.Pronucleus
I guess the taskmanager call taskkill internally? they are actually samething?Howsoever
@lzprgmr - taskkill and "end task" probably both call the same underlying windows function "TerminateProcess" msdn.microsoft.com/en-us/library/windows/desktop/…Midlothian
THis is no more effective then "end process" from task manager.Abstain
Using /T will also kill any processes started by that process (like using "end process tree" in task manager)Lallans
I've been trying to forcefully kill SugarSync.exe without having to reboot (since restarting SugarSync twice before it really gets going makes it work again), but taskkill /T /F /IM SugarSync.exe doesn't work--even though it claims "SUCCESS"Destination
Based on other answers I've found online, I tried again, this time using PsExec -sid cmd.exe , verifying with whomai that I am indeed "nt authority\system", and running taskkill /T /F /IM SugarSync.exe . (From Sysinternals.) No dice. It again claims "SUCCESS" but the process is still showing in Task Manager. Ditto if I find the process ID and run pskill -t 5652Destination
Beautiful, I have been looking for this command forever (I should note that I came here looking for a way to end process from the command line, so the fact that it is not "more powerful is ok with me)Zeist
Taskkill is not a general windows 7 command (only in the ultimate or professional). Only the much inferior tskill is part of all recent windows versions.Kenlee
THANK YOU! taskkill /pid 1234 /f does work when End Task refuses to work! WOW!Miskolc
@Eddie. This IS more effective then "end process" from task manager. I just killed a process with it, task manager refused to kill. Even if it may run the same code under the hood (I'm not saying it does) you have the freedom to run this command with different privilege levels.Immovable
ERROR: The process "RMPARTUSB.exe" with PID 5224 could not be terminated. Reason: There is no running instance of the task If there's no running instance how does it have a PID?Ablution
@AaronFranke Try "tasklist" and note the PID beside RMPARTUSB.exe in that list. Then run taskkill /pid ### with the correct PID in place of ###.Midlothian
@Slava: You were using the wrong button in Task Manager. "End Task" button sends a polite request, similar to kill -TERM "End Process" button calls TerminateProcess, similar to kill -9Votyak
"different privilege levels" are not a valid argument - you can run task manager with "different privilege levels", too.Mesopause
H
41

Process Hacker has numerous ways of killing a process.

(Right-click the process, then go to Miscellaneous->Terminator.)

Harquebusier answered 7/6, 2014 at 8:17 Comment(17)
Can't find much in the way of corroboration, as searching for this just yields millions of FREE DOWNLOAD!!! links. But it does what it says it does, virus risks and all.Titbit
This program worked ok for us. We killed two programs which were unkillable with the other tools mentioned in this thread.Heyerdahl
@Mehrdad Could you explain how you got to that screen?Rounds
@Nuzzolilo: Sure! Right-click the process, go to Miscellaneous->Terminator.Harquebusier
Does not work on all processes, I had one that survived all options.Karelian
That one worked where Task Manager, Process Explorer and taskkill failed. Thank you for the tip!Felon
@Zitrax: I think the only thing you can try at that point is turning it off and on again. =PHarquebusier
The funny thing here is that this program got stuck while I tried to kill another process. So I had to use Task Manager to kill this program. :-)Lantern
It bluescreened my computer. The process went away after the reboot. Good job... -.-'Nibble
I had this problem when closing an application launched from Visual Studio in Debug Mode and I have solved using ProcessHacker and "Miscellaneous->Detach From Debugger" on the process..Rutheruthenia
@Mehrdad, So when we do normal End Process from task manager, which option is it equivalent to?Heterochromous
@Pacerier: The first one.Harquebusier
process hacker helped me kill the chrome.exe crashing processAustin
Unfortunately Terminator is removed in v2.39 :(Gasper
@raymai97: Oh no :(Harquebusier
There is no Terminator option in Process Hacker 2.Ablution
Use Task-Manager to Force the Program to Quit Perform Following Steps for this: - Open Task Manager using the CTRL+SHIFT+ESC Keyboard shortcut. - Click On Processes Tab - Select appropriate Image name which you are looking for quit - Click on 'End Process' button Thanks.Stalk
M
29

JosepStyons is right. Open cmd.exe and run

taskkill /im processname.exe /f

If there is an error saying,

ERROR: The process "process.exe" with PID 1234 could not be terminated. Reason: Access is denied.

then try running cmd.exe as administrator.

Marleen answered 3/5, 2014 at 7:28 Comment(5)
Running as administrator, the error changes. It now says: ERROR: The process with PID 17888 (child process of PID 17880) could not be terminated. Reason: There is no instance of the task. and it is referring to the parent PID 17880. As it can't find the parent, it won't kill the orphaned child. :(Glebe
"you must kill child process too if any spawned to kill successfully your process" try this #12529463Marleen
In my case, the zombie process I told it to kill was the only child and there was no parent, though the zombie still thought it had a parent. In my case, resolved by using the Windows 8.1 Settings Advanced Repair System path, but canceling from actually wiping any disk, and just doing a full forced reboot. The regular shutdown and reboot is really sleep/hibernation (to save time on startup). Non-trivial getting it to do a full shutdown.Glebe
"Access is denied" means that the process is already in the process of being closed. For example if you had just attempted to close it earlier. You'll need to wait till it gets closed.Heterochromous
taskkill results under admin rights: Access is denied.Inveracity
B
22

Get process explorer from sysinternals (now Microsoft)

Process Explorer - Windows Sysinternals | Microsoft Docs

Birkle answered 8/9, 2008 at 15:49 Comment(1)
That does provide more info (and some limited ability to search for lock handles) but I've not had any more success at killing tasks with it than with basic Task Manager. Certain processes (like anti-virus, and SugarSync.exe) simply refuse to die.Destination
O
16

One trick that works well is to attach a debugger and then quit the debugger.

On XP or Windows 2003 you can do this using ntsd that ships out of the box:

ntsd -pn myapp.exe

ntsd will open up a new window. Just type 'q' in the window to quit the debugger and take out the process.

I've known this to work even when task manager doesn't seem able to kill a process.

Unfortunately ntsd was removed from Vista and you have to install the (free) debbugging tools for windows to get a suitable debugger.

Olden answered 8/9, 2008 at 16:0 Comment(5)
Thank you SO MUCH for this. Add "-c q" (w/o quotes) to autoquit, which makes it ideal process killer.Sisley
When Visual Studio and an application being debugged both hang, attach and kill the old instance of VS. The killer can be a new instance of VS, which can then open the old project and allow you to continue working.Tool
I can't figure out how to download anything from that link other than winsdk_web.exe, which does nothing.Briareus
You can now get it in the Windows 10 SDK by running the installer and then unchecking everything but "Debugging Tools for Windows" (learn.microsoft.com/en-us/windows-hardware/drivers/debugger/…)Kirkwall
this doesn't work if the unkillable process is something you were debugging when VS crashed, since the phantom process still believes it's attached to a debugger. Even invoking VS again and trying to attach back will error. I had to restart my computer.Dejong
H
6

setup an AT command to run task manager or process explorer as SYSTEM.

AT 12:34 /interactive "C:/procexp.exe"

If process explorer was in your root C drive then this would open it as SYSTEM and you could kill any process without getting any access denied errors. Set this for like a minute in the future, then it will pop up for you.

Histopathology answered 15/12, 2012 at 16:46 Comment(1)
I get the following warning when trying this, so it seems to no longer work: "Warning: Due to security enhancements, this task will run at the time expected but not interactively. Use schtasks.exe utility if interactive task is required ('schtasks /?' for details)."Locomobile
M
1

FYI you can sometimes use SYSTEM or Trustedinstaller to kill tasks ;)

google quickkill_3_0.bat

sc config TrustedInstaller binPath= "cmd /c TASKKILL /F  /IM notepad.exe
sc start "TrustedInstaller"
Metaphosphate answered 28/2, 2019 at 16:35 Comment(0)
B
1

I had this issue too, here is how I solved it.

1/ Open the « task manager « 

2/ Locate the application name in the list

3/ Once found, right click on its name then click on « properties »

4/ In the properties interface, click on « security « 

5/ Click on « edit » to change permissions

6/ « Deny » all permissions for all users, click on «  apply » then « ok »

7/ click on « advanced » for special permissions settings

8/ Remove permissions for all users

9/ click on «  apply » then « ok »

10/ click on «  apply » then « ok » again

11/ you can now kill the process on task manager as well as uninstall the app of you want to.

Beaded answered 21/4, 2021 at 3:3 Comment(0)
E
0

When ntsd access is denied, try:

ZeroWave was designed to be a simple tool that will provide a multilevel termination of any kind of process.

ZeroWave is also a easy-to-use program due to its simple installation and its very friendly graphical interface.

ZeroWave has three termination modes and with the "INSANE" mode can terminate any kind of process that can run on Windows.

It seems that ZeroWave can't kill avp.exe

Eructate answered 13/12, 2011 at 4:59 Comment(0)
H
0

wmic process where processid="11008" call terminate

Headfirst answered 21/6, 2022 at 17:9 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.