TASKKILL [/S system [/U username [/P [password]]]]
{ [/FI filter] [/PID processid | /IM imagename] } [/T] [/F]
Description:
This tool is used to terminate tasks by process id (PID) or image name.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which the command should execute.
/P [password] Specifies the password for the given user context. Prompts for input if omitted.
/M [module] Lists all tasks currently using the given exe/dll name. If the module name is not specified all loaded modules are displayed.
/SVC Displays services hosted in each process.
/V Displays verbose task information.
/FI filter Displays a set of tasks that match a given criteria specified by the filter./PID processid Specifies the PID of the process to be terminated. Use TaskList to get the PID.
/IM imagename Specifies the image name of the process to be terminated. Wildcard '*' can be used to specify all tasks or image names.
/T Terminates the specified process and any child processes which were started by it.
/F Specifies to forcefully terminate the process(es).
/? Displays this help message.
Filters:
| Filter Name | Valid Operators | Valid Value(s) |
| STATUS | eq, ne | RUNNING | NOT RESPONDING | UNKNOWN |
| IMAGENAME | eq, ne | Image name |
| PID | eq, ne, gt, lt, ge, le | PID value |
| SESSION | eq, ne, gt, lt, ge, le | Session number |
| SESSION NAME | eq, ne | Session name |
| CPU TIME | eq, ne, gt, lt, ge, le | CPU time in the format of hh:mm:ss. hh - hours, mm - minutes, ss - seconds |
| MEMUSAGE | eq, ne, gt, lt, ge, le | Memory Usage in KB |
| USERNAME | eq, ne | User name in [domain\]user format |
| SERVICES | eq, ne | Service Name |
| WINDOWTITLE | eq, ne | Windows Title |
| MODULES | eq, ne | DLL Name |
NOTE
- Wildcard '*' for /IM switch is accepted only when a filter is applied.
- Termination of remote processes will always be done forcefully (/F).
- "WINDOWTITLE" and "STATUS" filters are not considered when a remote machine is specified.
Examples
TASKKILL /IM notepad.exe
TASKKILL /PID 1230 /PID 1241 /PID 1253 /T
TASKKILL /F /IM cmd.exe /T
TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*"
TASKKILL /F /FI "USERNAME eq NT AUTHORITY\SYSTEM" /IM notepad.exe
TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM *
TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"
Associated Commands