TheWon's IT Blog

1. Go to the command-prompt and query the service (e.g. the SMTP service) by using sc:
   
   sc queryex SMTPSvc
   
   
2. This will give you the following information:
   
   SERVICE_NAME: SMTPSvc
           TYPE               : 20  WIN32_SHARE_PROCESS
           STATE              : 4  RUNNING
                                   (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)
           WIN32_EXIT_CODE    : 0  (0x0)
           SERVICE_EXIT_CODE  : 0  (0x0)
           CHECKPOINT         : 0x0
           WAIT_HINT          : 0x0
           PID                : 388
           FLAGS              :
   
   or something like this (the "state" will mention stopping).
   
3. Over here you can find the process identifier (PID), so it's pretty easy to kill the associated process either by using the task manager or by using taskkill:
   
   taskkill /PID 388 /F
   
   where the /F flag is needed to force the process kill (first try without the flag).

C:\Documents and Settings\Administrator>sc queryex rpcss

SERVICE_NAME: rpcss
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 2332
        FLAGS              :

C:\Documents and Settings\Administrator>taskkill /pid 2332 /F
SUCCESS: The process with PID 2332 has been terminated.

C:\Documents and Settings\Administrator>shutdown /a

C:\Documents and Settings\Administrator>sc start rpcss

SERVICE_NAME: rpcss
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 2520
        FLAGS              :

C:\Documents and Settings\Administrator>sc queryex rpcss

SERVICE_NAME: rpcss
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 2520
        FLAGS              :

taskkill /IM notepad.exe

This will cause the program to terminate gracefully, asking for confirmation if there are unsaved changes. To forcefully kill the same process, add the /F option to the command line. Be careful with the /F option as it will terminate all matching processes without confirmation.

To kill a single instance of a process, specify its process id (PID). For example, if the desired process has a PID of 827, use the following command to kill it:

taskkill /PID 827

Using filters, a variety of different patterns can be used to specify the processes to kill. For example, the following filter syntax will forcefully kill all processes owned by the user Quinn:

taskkill /F /FI "USERNAME eq Quinn"

The following table shows the available filters and their use.

Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------
STATUS eq ne RUNNING | NOT RESPONDING
IMAGENAME eq ne Image name
PID eq ne gt lt ge le PID value
SESSION eq ne gt lt ge le Session number.
CPUTIME eq ne gt lt ge le CPU time in the format
of hh:mm:ss.
MEMUSAGE eq ne gt lt ge le Memory usage in KB
USERNAME eq ne User name in [domain\]user
format
MODULES eq ne DLL name
SERVICES eq ne Service name
WINDOWTITLE eq ne Window title

eq: equals ne: not equal
gt: greater than lt: less than
gt: greater than or equal le: less than or equal