CODEWITHSUNDEEP
batch-filecmdprocesswmictaskkill
user149483
user149483

Reputation: 9

Terminating a Process from CMD: Softest to Hardest

Terminating a Process from CMD: Softest to Hardest I was wondering if anyone had experience using command line to terminate processes using taskkill and WIMC. I was wondering if anyone knew the order of how "hard" of a close/terminate these commands are from the command that is the "softest" (least forceful) close to the command that is the "hardest" (most forceful):

My guess would be:

Least/Softest

1) taskkill /im processname.exe

2) wmic process where name="processname.exe" call terminate

3) wmic process where name='processname.exe' delete

4) taskkill /f /im processname.exe

Most/Hardest

I am trying to create a batch command file and wanted to just know the difference between these, to see which I should use. I prefer to use a softer close, check to see if the process is still running, and then try a harder close, and then repeat this until the program is successfully closed. Any info on the difference between any of these would be helpful, especially between using terminate and delete via CMD: WMIC would be helpful, as I cannot find documentation anywhere on them.

Upvotes: 1

Views: 12002

Answers (2)

OneTouchForHeight
OneTouchForHeight

Reputation: 139

using wmic: print all running process where name of process is cmd.exe wmic process where name="cmd.exe" GET ProcessId, CommandLine,CreationClassName then terminate the specific instance of process by processId (PID) WMIC PROCESS WHERE "ProcessID=13800" CALL TERMINATE

Upvotes: 0

Jack White
Jack White

Reputation: 916

As CatCat mentioned, there are two main ways to terminate a process : WM_CLOSE and TerminateProcess(). I've included two more for completeness sake.

  1. Sending window message WM_CLOSE to the main window of the process. This is the same message an application receives when user clicks X button to close the window. The app may then gracefully shutdown or ask user for confirmation - for example if some work is unsaved.

    taskkill without /f appears to attempt doing that but seems to not always succeed in finding the correct window to close. If the app is supposed to not have a visible window (such as if it only displays an icon in system tray or is a windowless server) it may ignore this message entirely.

    If taskkill does not work for you, it is possible NirCmd: does better job: NirCmd.exe closeprocess iexplore.exe

  2. There is also WM_ENDSESSION message - it it sent by the OS when shutting down (after WM_QUERYENDSESSION). It works pretty much the same way except it is sent to whole application rather then a specific window. Depending on parameters, apps may be requested to save the work into temporary files because the system needs to restart to apply some updates. Some applications react to this message, some don't.

    It should be possible to send these messages manually, but I have not seen it done other than to test how app reacts to shutdown without actually shutting down OS.

  3. WM_QUIT message suggests the application as a whole needs to shut down (more specifically, it is sent to a thread). An application should normally post it to itself after its window is done closing and now it is time to end the process.

    It is possible to manually post the message to every thread of another process but this is hackish and rare, it may crash processes not expecting to be issued this message from outside. I'm not sure if it's a better option than just terminating the process or not.

  4. TerminateProcess() tells the OS to forcefully terminate the process. This is what happens when you click End process button on processes tab in the task manager. The process does not get notified it is being closed - it is just stopped where it was and removed from the memory - no questions, no shutdown, etc. This may cause corruption if some files were being written at that time or data transferred.

    That is what taskkill /f command does. Both wmic process call terminate and wmic process delete appear to also do this although I'm not sure.

Upvotes: 2

Related Questions