Process stuck? Terminate remotely!

I recently worked with a client that must have forgotten to give a sacrifice to the computer gods before coming to work. This oversight set in motion a series of unfortunate events that led to a failure of access for a database due to a stuck process. I discovered that the combination of issues which included; service loss, virtual machine console loss and remote desktop loss, made attempts to access the server and it’s application occupants futile. To make matters worse there were critical deadlines for the users of the database and users for other files on the server. The file access was not effected, so a restart of the server was out of the question.

So I had to get crafty. Lucky I had a couple of native (oldie but goodie) Windows cli commands, TaskList and TaskKill, to help get the client out of a jam. I knew this particular database service would restart itself if I could just terminate the process that was stuck… This is where TaskList and TaskKill come in. TaskList to show me the service Process ID or PID and TaskKill to terminate the PID.

Discovering the process ID

The first step is to find the PID of the process we need to terminate:

  1. Open command prompt
  2. Type tasklist /s {remote computer name} /u {domain | username} /p {password}

    TaskListCommandLine
    TaskList command line to remote machine example
  3. You’ll see a list returned of running processes from the remote machine. In this example, let’s pretend notepad.exe is a service I need to restart. Note down the PID. In this example it is 4944.

    TaskListCommandLineReturn
    TaskList command line return example

Once we have the PID we are now able to use this information to terminate the process using TaskKill.

Shutting down the process remotely

  1. Open command prompt
  2. Type taskkill /s {remote pc} /u {domain | username} /p {password} /PID {process id}

    TaskKillCommandLine
    TaskKill command line example
  3. If successful it will return “Success: The process with PID {PID} has been terminated”

    TaskKillCommandLineReturn
    TaskKill command line return example

Once you have a Success, the process has now stopped.

Issues

There are really only two errors you can get with these command line utilities. They are very generic and hard to decode, however here are the two errors and possible solutions to resolving them.

Error: The RPC server is unavailable.

This can happen for a few reasons; either the computer is off, the firewall is on or possibly the Remote Procedure Call (RPC) service is not running.

RPCServerUnavailable
RPC server unavailable example

Error: The user name or password is incorrect.

This error also has a few reasons behind it, however mostly it’s either your username and password are indeed wrong, or your account doesn’t have access to use RPC.

UsernamePasswordIncorrect
User name or password incorrect example

Why not use PowerShell?

The issue with PowerShell is listing the processes is as easy as using TaskList, but actually terminating the process starts to get more complicated. As you can see below the Stop-Process function isn’t allowed to be used for remote machines. To get around this you need to use WMI. This has it’s own complications around firewalling, remote WMI enablement and permissions. In this case, they had no WMI remote management enabled nor did they have the right firewall ports open. Sometimes the simplest solution is the best.

PowerShellGet-ProcessWMI
Using PowerShell to get process list and try and terminate an executable with native PowerShell and WMI.

Summary

So there you have it, an easy and elegant way to terminate a process or service remotely without too much fuss. Also note we still needed to restart that server after hours to get access back for remote desktop and the console. The reason to why this all happened is still being investigated. Though without this trick the client would have had to restart during the day causing disruption to all users, not just a select few.

Joshua Bauer
Operations Manager – Vantage Networks

If you have any questions about terminating remote processes or any other features provided by TaskList and TaskKill or even PowerShell, reach out.

Don’t forget to Follow us on LinkedIn!