4 ms·
"- There should be nothing that TaskMgr can't kill - it will even escalate privilege and (if you have it) enable debug privilege to attach to and kill apps that
by voltagex_ 6y ago
"- There should be nothing that TaskMgr can't kill - it will even escalate privilege and (if you have it) enable debug privilege to attach to and kill apps that way if needed. If TM can't kill it, you've got a kernel problem."
I've seen stuff that taskmgr can't kill - I haven't ever seen it use any debugging privileges that I know of.
- muststopmyths 6y agolike he said, kernel problem. Most likely a driver holding on to a handle opened by a process by not cancelling I/O properly. to my recollection the most common case, but could be similar other reasons.
- asveikau 6y agoI think it also used to be able to kill msmpeng.exe but it now fails with access denied. I assumed it was intentional because they don't want to kill antivirus. But it is a CPU hog, often at critical times, so I used to find myself killing it a lot in past releases.
- KiwiJohnno 6y agoIn windows processes have an access control list, just like file permissions. MsMpEng.exe (and other sometimes other critical system processes and antivirus scanners etc) can't be killed because only system has permission, not administrators. Process Explorer allows you to view and modify a process access control list (if you have permission). If you use psexec to run process explorer as system, then you can get into the access control list of these processes and add permission for administrator (or just kill them from there...)
- asveikau 6y agoI am ex msft. I have written windows code in kernel mode. I know that there are acls. I know about psexec too. I was not talking about any of that, but Task Manager as this thread was about. Personally if I were killing with psexec I would try invoking taskkill.exe.
- KiwiJohnno 6y agoAh, ok, sorry I was just trying to be helpful, I wasn't trying to teach you to suck eggs :) But my main point was (that I implied, but I didn't say) is yes, I remember killing off early versions of microsoft security essentials (when that was its name) with task manager too. Logically, back then the process didn't have a restricted ACL, but it now does. I didn't actually know you could specify the system user when killing a process with taskkill, thanks
- brynjolf 6y agoSuspended apps don't show up and have to be killed through wmic sometimes
- randkyp 6y agoI've had better luck killing such "unkillable" processes with taskkill.exe /f /im program.exe instead.
- RMPR 6y agoYou forgot sudo
- CawCawCaw 6y agoI would guess that protected processes with at least Tcb level (which denies PROCESS_TERMINATE) can't be killed in this way.
- toyg 6y agoI suspect the author had moved on from MS by the time XPSP2 dramatically restricted security privileges in Windows.