Remote Task kill

How to kill process on remote computer?

In Windows, we can kill processes running on a remote computer using the taskkill command. We can specify process id/image file name/user name to identify the processes that need to be killed. Below you can find the syntax for each of the cases with examples.

Kill remote process using process id.
The syntax for this case is as below

Taskkill /S remoteServer /u userName /PID processId

Example:

c:\>taskkill /S 10.132.79.23 /u administrator /PID 5088
Type the password for administrator:******
SUCCESS: The process with PID 5088 has been terminated.

We can as well specify FQDN name of the computer for /S option. We can add /P switch to the above command, to specify the password in the command itself. This will allow the command to be executed from a batch file, without any user interaction.

Kill remote process using image name
We can use filter option (/FI) to specify the image name. The syntax is as given below.

taskkill /s remoteServer /u userName /FI "IMAGENAME eq filename"

For example, if I need to kill all command window processes, I would run the below command.

taskkill /s 10.132.79.23 /u administrator /FI "IMAGENAME eq CMD.EXE"

If you need to kill outlook process, the command would be:

taskkill /s 10.132.79.23 /u administrator /FI "IMAGENAME eq OUTLOOK.EXE"

Kill processes executed by a particular user
The command is similar to the previous case with one change. Instead of ‘imagename‘, now we use ‘username‘ in the filter argument.

taskkill /s remoteServer /u userName /FI "USERNAME eq userLoginId"

Viewing the list of processes on remote computer
We can get the remote processes list using tasklist command.
To get list of all the processes, the command is :

tasklist /s remoteServer /u userName

To list the processes running a particular image file:

TASKlist /S remoteServer /u userName /FI “IMAGENAME eq filename”
Example: To get the list of processes running cmd.exe on the remote computer 10.132.79.23, the command is:

c:\>Tasklist /S 10.132.79.23 /u administrator /FI "IMAGENAME eq CMD.EXE"
Type the password for administrator:******

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
cmd.exe                       4272                            3      2,336 K
cmd.exe                       4448                            3      2,276 K
cmd.exe                       5008                            1      2,392 K
cmd.exe                       4228                            0      2,032 K
cmd.exe                       2344                            0      2,024 K
cmd.exe                       5552                            0      2,028 K
cmd.exe                       2936                            0      2,024 K
cmd.exe                       3776                            1      6,248 K