How To View and Kill Processes On Remote Windows Computers
Windows provides several methods to view processes remotely on another computer. Terminal Server is one way or you can use the command line utility pslist from Microsoft Sysinternals site. While both options are good alternatives, Windows XP and Vista provides a built in utility for viewing and killing process on remote Computers using Tasklist and Taskkill commands.
Both tasklist.exe and taskkill,exe can be found in %SYSTEMROOT%\System32 (typically C:\Windows\System32) directory.
To view processes on a remote Computer in your home, you will need to know the username and password on the Computer you want to view the processes. Once you have the user account information, the syntax for using tasklist follows:
tasklist.exe /S SYSTEM /U USERNAME /P PASSWORD
(To view all tasklist options, type tasklist /? at the command prompt)
To execute, click on Start \ Run… and in the run window type cmd to open a command prompt. Then type the tasklist command, substituting SYSTEM for the remote computer you want to view processes, USERNAME and PASSWORD with an account/password on the remote Computer.
(NOTE: if you are in a Domain environment and have Administrator rights to the remote Computer, you will may not need to specify a Username and Password)
Now if there was a process that needed to be killed, you can use the taskill command. As with tasklist, you will also need the Username and Passoword on the remote Computer. The syntax for using taskkill is
taskkill.exe/S SYSTEM /U USERNAME /P PASSWORD /IM PROCESS
(To view all taskkill options, type tasklll /? at the command prompt)
Where SYSTEM, USERNAME, PASSWORD is the same as above for the tasklist command, and IM is the process image name you want to kill. In the above screen shot we will kill firefox.exe by typing the following at the command prompt:
taskkill.exe /S wtn1 /U joe /P ddd1234 /IM firefox.exe
SUCCESS: The process "firefox.exe" with PID 196 has been terminated
You can also kill a process using the PID (Process ID) of the process. In the above example the PID for firefox.exe is 196:
taskkill.exe /S wtn1 /U joe /P ddd1234 /PID 196
If the process does not terminate, you can use /F to forcefully terminate the process.
taskkill.exe /S wtn1 /U joe /P ddd1234 /PID 196 /F
Filed under Windows Tips, Windows Vista Tips by Watching The Net
Comments on How To View and Kill Processes On Remote Windows Computers »
thanks for this tip. However, I have tried both listing and killing a process on a computer on the network without success. It returns the message, "The RPC Server is unavailable". I typed tasklist.exe /S computername /U username /P password.
Please let me know whwer i am wrong.
@Boniface
More than likely the ports are being blocked by a firewall or a policy is in place preventing remote management of the computer you are trying to reach.
I can do this however when i type in the domain and password it connects and then requests a password again even though the aaccount I am trying to access has no password.
Why is this?
Without turning off the built-in firewall, how (which TCP&UDP ports) do you open it to allow the remote access. I have fiddled with this to death and cant figure it out. If we turn off Windows Firewall - it WORKS, but when on, no matter what normal RPC/DCOM ports we try, it just wont work (135-139, 445, 1035, 1900, etc)
Getting very frustrated!!!
@jman_va
Running "netstat -an" (no quotes) shows ports 135, 139 & 4371 (TCP/UDP).
If it still does not work for you, you may want to run a sniffer (Wireshark) and see if other ports are needed.
If you have security concerns with opening up too many ports, your best bet is use the RDP protocol (TCP port 3389) instead of tasklist & taskkill for management of Windows desktops.
Is there any restrinction with XP SP2?? I get an error message:
'TASKLIST is not recognized as an internal or external command, operable program or batch file'
I checked the System32 folder and I do not have any of the files.
@Vianick
If you have Windows XP Home, tasklist.exe is not included (it is with XP Professional).
Instead, download it from this link.
Thanks, that was really usefull. Would it be a lot to ask if you have the taskkill too?? Thanks
@Vianick
Not at all. Try this link.
Thank you big time, I managed to view the process using tasklist /u Ip /username /Pword.
But I can not kill the processes using(/IM process or /PID pid) I do not know what's up. Help plz!
I'm using XP pro. accessing MS Server 2003 remotely.
Regads
LS
@lulu
What is the error message you receive when trying to kill process?
Also, make sure you have Administration rights on the system you are trying to kill processes.
usually you get RPC server unavailable because the computers local security policies dont allow you to connect to the PC… if you have XP PRO [i havnt used any other OS with remote process list /kills or remote shutdown] you need to go to control panel>Administritive tools>local security policy>local policies>find network accesss sharing and security blah blah, double click and change from guests only to classic-users identify themselves… this should work, change this option on both PC's, other than this i cant help you
this problem may back to your windows firewall if you using XP sp2. check this link support.moonpoint.com/os/windows/xp/firewall/rpc-server-unavailable
For Vista, tick the following exception in the firewall :
Windows Management Instrumentation (WMI)
Thanks!
Thaks alot!! it works.
I've tried several types of login:
tasklist /s kenyer /u abydos /p *******
tasklist /s kenyer /u KENYER\abydos /p *******
tasklist /s kenyer /u abydos -> asking for pw: i type it
but always get the message that wrong username or password…
Any idea? (i can log in with remote desktop)
@abydos
Is system you are trying to connect, part of a domain or workgroup? If so, you may need to prefix the user name with the domain or workgroup.
For example if the domain name or workgroup is ABCD:
/u ABCD\username
Or if the account is local to the system, prefix it with the remote computer name:
/u computername\username
Also, make sure the account you are using has the necessary rights to kill processes on the remote system..
very useful! i've make a copy in my blog , hope u don't mind.
Hi There, is there a way to find out what %age of the processor is being used by what process?
Thanks
Rob
THANK YOU FRO THE INFO…
BUT IS THERE ANY WAY TO DO THIS WITHOUT CHANGING THE FIREWALL SETTINGS FOR THE REMOTE MACHINE
@ARUN
If the ports on the firewall of the remote machine are not open, than you can't use the above commands. Otherwise you need to use another method or physically access the machine.