How To View and Kill Processes On Remote Windows Computers

67

vista.jpgWindows provides several methods to view processes remotely on another computer. Terminal Server is one way or you can use the command line utility pslist from Microsoft Sysinternals site. While both options are good alternatives, Windows XP and Vista provides a built in utility for viewing and killing process on remote Computers using Tasklist and Taskkill commands.

Both tasklist.exe and taskkill,exe can be found in %SYSTEMROOT%\System32 (typically C:\Windows\System32) directory.

To view processes on a remote Computer in your home, you will need to know the username and password on the Computer you want to view the processes. Once you have the user account information, the syntax for using tasklist follows:

tasklist.exe /S SYSTEM /U USERNAME /P PASSWORD

(To view all tasklist options, type tasklist /? at the command prompt)

To execute, click on Start \ Run… and in the run window type cmd to open a command prompt. Then type the tasklist command, substituting SYSTEM for the remote computer you want to view processes, USERNAME and PASSWORD with an account/password on the remote Computer.

(NOTE: if you are in a Domain environment and have Administrator rights to the remote Computer, you will may not need to specify a Username and Password)

tlist2.png

Now if there was a process that needed to be killed, you can use the taskill command. As with tasklist, you will also need the Username and Passoword on the remote Computer. The syntax for using taskkill is

taskkill.exe/S SYSTEM /U USERNAME /P PASSWORD /IM PROCESS

(To view all taskkill options, type tasklll /? at the command prompt)

Where SYSTEM, USERNAME, PASSWORD is the same as above for the tasklist command, and IM is the process image name you want to kill. In the above screen shot we will kill firefox.exe by typing the following at the command prompt:

taskkill.exe /S wtn1 /U joe /P ddd1234 /IM firefox.exe
SUCCESS: The process "firefox.exe" with PID 196 has been terminated

You can also kill a process using the PID (Process ID) of the process. In the above example the PID for firefox.exe is 196:

taskkill.exe /S wtn1 /U joe /P ddd1234 /PID 196

If the process does not terminate, you can use /F to forcefully terminate the process.

taskkill.exe /S wtn1 /U joe /P ddd1234 /PID 196 /F

Comments on How To View and Kill Processes On Remote Windows Computers Leave a Comment

November 28, 2007

Boniface @ 1:21 am #

thanks for this tip. However, I have tried both listing and killing a process on a computer on the network without success. It returns the message, "The RPC Server is unavailable". I typed tasklist.exe /S computername /U username /P password.
Please let me know whwer i am wrong.

February 17, 2008

John @ 11:54 am #

I can do this however when i type in the domain and password it connects and then requests a password again even though the aaccount I am trying to access has no password.

Why is this?

March 19, 2008

jman_va @ 2:04 pm #

Without turning off the built-in firewall, how (which TCP&UDP ports) do you open it to allow the remote access. I have fiddled with this to death and cant figure it out. If we turn off Windows Firewall – it WORKS, but when on, no matter what normal RPC/DCOM ports we try, it just wont work (135-139, 445, 1035, 1900, etc)

Getting very frustrated!!!

March 20, 2008
April 13, 2008

Vianick @ 1:59 pm #

Is there any restrinction with XP SP2?? I get an error message:

'TASKLIST is not recognized as an internal or external command, operable program or batch file'

I checked the System32 folder and I do not have any of the files.

Vianick @ 2:22 pm #

Thanks, that was really usefull. Would it be a lot to ask if you have the taskkill too?? Thanks

May 16, 2008

lulu @ 8:04 am #

Thank you big time, I managed to view the process using tasklist /u Ip /username /Pword.
But I can not kill the processes using(/IM process or /PID pid) I do not know what's up. Help plz!
I'm using XP pro. accessing MS Server 2003 remotely.

Regads
LS

September 10, 2008

Lex @ 9:08 pm #

usually you get RPC server unavailable because the computers local security policies dont allow you to connect to the PC… if you have XP PRO [i havnt used any other OS with remote process list /kills or remote shutdown] you need to go to control panel>Administritive tools>local security policy>local policies>find network accesss sharing and security blah blah, double click and change from guests only to classic-users identify themselves… this should work, change this option on both PC's, other than this i cant help you

October 11, 2008

killer @ 8:47 am #

this problem may back to your windows firewall if you using XP sp2. check this link support.moonpoint.com/os/windows/xp/firewall/rpc-server-unavailable

October 23, 2008

Tim @ 1:20 am #

For Vista, tick the following exception in the firewall :
Windows Management Instrumentation (WMI)

December 7, 2008

Raj @ 9:27 pm #

Thanks!

January 24, 2009

som @ 10:43 pm #

Thaks alot!! it works.

February 21, 2009

abydos @ 6:58 pm #

I've tried several types of login:
tasklist /s kenyer /u abydos /p *******
tasklist /s kenyer /u KENYER\abydos /p *******
tasklist /s kenyer /u abydos -> asking for pw: i type it

but always get the message that wrong username or password…
Any idea? (i can log in with remote desktop)

April 20, 2009

joe @ 12:20 am #

very useful! i've make a copy in my blog , hope u don't mind.

May 26, 2009

Rob @ 5:41 am #

Hi There, is there a way to find out what %age of the processor is being used by what process?

Thanks

Rob

June 24, 2009

ARUN @ 11:38 am #

THANK YOU FRO THE INFO…
BUT IS THERE ANY WAY TO DO THIS WITHOUT CHANGING THE FIREWALL SETTINGS FOR THE REMOTE MACHINE

June 27, 2009
July 22, 2009

derek @ 8:23 am #

Thanks. This info really helped me with getting rid of the virus called Symantec at my office. Works like a charm!

July 23, 2009

Constantin @ 5:02 am #

Trying to kill a process using taskkill but getting the following, although I use the /F option.
Any ideas?

Thanks

C:\>taskkill /s gbrpwmw0329094 /f /PID 784
ERROR: The process with PID 784 could not be terminated.
Reason: This is critical system process. Utility cannot end this process.

November 22, 2009

xp owner @ 8:14 pm #

@Watching The Net

i have the invalid user or password error aswell

have xp home on 1 pc, xp pro on the other
downloaded the tasklist & taskkill from here for my xp home pc

I have also tried ur tip:
For example if the domain name or workgroup is ABCD:
/u ABCD\username
Or if the account is local to the system, prefix it with the remote computer name:
/u computername\username
Also, make sure the account you are using has the necessary rights to kill processes on the remote system..

still i got the invalid user/password error

any suggestions? 🙁

January 16, 2010

Scott @ 5:47 am #

when I try run netstat to check connections i see the bios screen blink up then it dissapears whats the crack there and can someone help please

Jim @ 11:12 pm #

@Scott:

Are you running from a command line? It sounds to me like you are running that command straight from the >start>run box.

Make sure you launch the command prompt first and then run netstat -an to get the port listing.

January 17, 2010

Scott @ 6:16 am #

@Jim: thank u Jim thats exactly what i was doin duh me lol thanks a lot

January 20, 2010

Jason leow @ 6:52 pm #

Thanks this was a really great article. it saved us going to the remote server and doing a hard (ugly) reboot. Thank you so much

February 19, 2010

KEYUR @ 9:43 am #

its just amazing and very helpfull……thanks…….

April 29, 2010

Mick @ 10:58 am #

I'm desperately trying to get tasklist /s to work

it will only work for the local computer – any remote computers (eg: laptop) it just hangs forever

I realise I need to set the remote computer/s to allow some sort of access (they are on the "WORKGROUP" network and I can access files etc) – but I just can't find this information anywhere

all computers running XP sp2

please help………………

many thanks
Mick

Mick @ 5:02 pm #

Hi there

sorry "the typical netbios ports tasklist uses to communicate to the remote computers?" is a bit above my head –
……but I HAVE found I can get it to work by disabling the firewall on the laptop AND assigning a password to the laptop user name – neither of which are things I really want to do

even then it asks for the password to the local computer's user name

I just wanted to have a quick batch file to kill a program on the laptop to save me walking through the house – but now walking through the house seems a fantastically easy option – oooh I love Windows!!!

Mick

April 30, 2010

Mick @ 6:28 am #

Well thanks – that's very helpful

I didn't say that I LEFT the Firewall switched off – but as a previous correspondent it was the only way I could get it to work – nobody yet has suggested another way to get it to work –

Also I am not in an office situation so do not need or want unecessary passwords

anyway with your attitude you shouldn't be pretending to help people

Bye

June 4, 2010

Denny @ 2:51 pm #

I have one question.. how about if I want to attach the proces from remoted pc to software like cheat engine for hacking game.

if u don't mind please answer it to my email.

thanks.

June 15, 2010

colin @ 8:20 am #

Hi, this works for one remote computer but i want to run it on a whole load of them, how would i script this? you help is really appreciated.

thanks

July 8, 2010

John @ 11:48 am #

@Tim:
Ticking WMI worked for me on Win 7 Pro.
Thanks, Tim!

July 14, 2010

killer @ 6:04 am #

@colin:
i dont know actually get your mean .
u can simply use the bath files command

tasklist /S pc1 /U user1 /P password1
tasklist /S pc2 /U user2 /P password2
.
.
.

also you can windows api Shellexec in any programming language. if your network have a same user password or user and passwords stored in database or text file then the remote commands can be generated automatically
vbScript
open=ShellExec "taskkill /s "+IPString+" /u samesuer /p samepass /im sameproc"

August 1, 2010

Simon Cornell @ 11:00 pm #

Does anyone know how I can see what the full command line is of the remote processes?
Thanks

August 18, 2010

eXcalibre @ 12:12 pm #

Well i think this is a great little helper file.

Its really useful for removing viruses that stop any programs running that will allow you to remove them.

Thank you.

September 21, 2010

Michael Young @ 5:04 am #

Worked ok for me and saved me a lot of time. Thanks.

November 30, 2010

Vijay Saini @ 6:03 am #

Thanks, It worked for me

January 11, 2011

boondoggle @ 2:48 am #

Had trouble getting this enabled on a Win 7 machine. Finally did the following: opened PowerShell as Administrator, and used the following command: Enable-PSRemoting

Fixed all firewall and services issues.

January 12, 2011

rod @ 12:23 pm #

from my server y can kill remote process from all of the lan pcs. i cannot get inside of two of them. they have win2kpro. any suggestion?

February 22, 2011

vamsi @ 4:45 am #

I tried it at my college but i didn't succeed please let me know any other wat to get this
thank u———vamsi

October 3, 2011

ashok @ 3:46 am #

i try with

C:\Documents and Settings\great1>tasklist /s ashok /u great
Type the password for great:****

ERROR: Logon failure: unknown user name or bad password.

what is wrong i have made…
???????????????

October 7, 2011

killer @ 8:28 am #

@rod:
if you have fire wall ?
check port 445
check your system configure

ashok @ 10:39 pm #

sir i have turn off the firewall on both pc's(remote and local)…
i m using windows xp professional sp2…

i have configured the remote desktop and it is working but tasklist is not working…

what else i need to be configured..?

October 12, 2011

killer @ 4:52 pm #

@killer:
it back to your user name and password .
your user (great) must be registered in "ashok" system

killer @ 4:54 pm #

@ashok:
it back to your user name and password .
your user (great) must be registered in "ashok" system

October 13, 2011

ashok @ 3:32 am #

yes, i m using the same username(great)
and password to login into the computer(named ashok).

October 17, 2011

Joel @ 12:58 pm #

I couldn't find an answer for my RPC woes in Windows 7. So I had a look in the Windows Firewall and saw these guys:

Remote Administration (RPC) rule

I flipped on the one with the Domain profile (since I'm connected via VPN so I'm on the domain) and this solved my problems.

December 4, 2011

steven @ 2:12 am #

can u use this in creating a client server??

steven @ 2:14 am #

am i trying to create a client server program using vb can anyone help me..

December 6, 2011

killer @ 3:55 pm #

@steven:
this commands are server and client that has created before ,
if you want use this commands in side of your application one way is using api like shellexec.
in other hand ,if you want create new client server u must use the winsocket to comunication between client and server. this is out of our discussion.

December 22, 2011

Matt @ 11:11 am #

Thanks very much. These commands allowed me to remotely view and kill a malware process that had disabled task manager and regedit on the local infected machine. Can't thank you enough!

July 26, 2012

Nick @ 9:19 am #

@John:

Windows can throw a tantrum if an account doesn't have a password. I would suggest setting one and seeing if that helps. (I know the comment is 4 years old, but it might help someone)

December 12, 2012

KinDn3ss @ 4:14 pm #

Beautiful outlined the purpose of this forum topic. Helpful – done my job as an Engineer, and I'm good to go. Thanks "Watching The Net".

May 27, 2013

Kevin peterson @ 8:19 am #

Very good article. By using remote support tools such as logmein, gosupportnow, GoToMyPC, RHUB appliances etc. one can kill Processes on Remote Windows Computers.

May 28, 2013

killer @ 6:46 am #

@Kevin peterson:
the main advantage of taskkill and tasklist is the distributing by ms windows

June 30, 2013

Nathan @ 11:21 pm #

is there anyway to pass the currently credentials?

So if user runs script it runs under that users credentials so you don't have to put in credentials?

September 30, 2015

rose12 @ 10:28 am #

Although not meant for monitoring remote Windows PCs, but if anyone is interested in monitoring Windows Embedded Compact devices (or WinCE devices) from their PC remotely, the Remote Task Monitor is a good option.

http://www.remotetaskmonitor.com/

The thing I found helpful was being able to remotely restart the device, and get CPU usage alerts and emails when certain CPU threshold or peak is reached.

It is not free, but does the job for us well.

June 1, 2016

Abhishek M @ 3:01 pm #

@John:Null passwords are not accepted. The remote system has to have a password

August 21, 2016

Kill Processes @ 4:06 pm #

nice thank you for this great work,

Leave a Comment

Fields marked by an asterisk (*) are required.

Subscribe without commenting