Taskkill - DOS/Command Prompt Reference
[Windows XP Professional / Vista or later] Terminates the processes running on the computer.
Syntax
taskkill[.exe] [/S <remote-system> [/U <user-name> [/P [<password>]]]]
{/FI <filter> | /PID <process-id> | /IM <image-name>}
[/T] [/F]
* /FI, /PID, and /IM require at least one to be specified, and /PID and /IM cannot be specified simultaneously. However, /PID and /IM can each be specified simultaneously with /FI.
Options
| /S <remote-system> |
Specifies the name of the computer (local/remote) where the process you want to terminate exists. <remote-system> will be an IP address or hostname. If omitted, the local computer is the target. Note that for processes on a remote computer, a forced termination will always be performed even without specifying /F. |
| /U <user-name> [/P [<password>]] |
Specifies the login name and password when providing a computer name. You can specify a domain name in <user-name> (in the form of ‘domain\username’). If omitted, the user who executed this command will be used. On ‘/P [<password>]’, if the entire ‘/P [<password>]’ is omitted, no password is set. If only ‘/P’ is specified (and ‘<password>’ is omitted), prompting the user to enter the password will occur (the entered password will be displayed as ‘*’ in the prompt). |
| /FI <filter> |
Narrows down (filters) the processes to be terminated. Please refer to Details for the available formats that can be specified. /FI can be specified multiple times. In such cases, it becomes an AND search (terminate only those that match all filters). |
| /IM <image-name> |
Filters the processes to be terminated based on the image name. If /IM is specified, only processes with image names matching the pattern specified here will be targeted for termination. The image name is typically the program file name, including the extension (e.g. foo.exe). You can also use the wildcard ‘*’, but if you specify only ‘*’, /FI must be specified. If ‘*’ is specified alone without /FI, an error will occur. /IM can be specified multiple times, and in that case, processes matching any of the specified <image-name> patterns will be targeted for termination (OR search). |
| /PID <process-id> |
Filters the processes to be terminated based on the Process ID (PID). The Process ID is a unique number assigned to each process and can be confirmed using programs such as Tasklist, Task Manager, or various process monitoring tools. Since Process IDs do not duplicate, there can be only one process that can be terminated with /PID. However, /PID can be specified multiple times, and in that case, processes corresponding to the specified PIDs will be targeted for termination (OR search). |
| /T |
If the target process is running another process (has child processes), those processes will also be targeted for termination. Note that when terminating child processes, the /FI (filter) check for the child processes is not performed. Therefore, using the /T option, it is not possible to selectively terminate only some of the child processes or prevent the termination of certain child processes. |
| /F |
Forcefully terminates the process. If /F is not specified, a termination signal is sent to the process. However, if specified, the process is terminated without sending any signals, which may result in the loss of unsaved data if the process had any. In some cases, such as programs without a main window, termination may not be possible without specifying the /F switch. |
Details
The Taskkill command allows you to terminate running processes (programs) from outside. If you terminate a process on the local computer without specifying /F, it sends a termination signal (WM_CLOSE message) to the main window of the process. However, if /F is specified or when terminating processes on a remote computer, it forcefully terminates the process.
There is a similar command Tskill, but Taskkill has features such as the ability to ‘terminate normally rather than forcefully’ and ‘select processes in more detail’.
Filters with /FI option
Filters specified with the /FI option are in the form of ‘<name> <op> <value>’ (enclose the entire expression in " "). The available filters are as follows (same as those that can be used with Tasklist, excluding ‘SESSIONNAME’).
| Filter name <name> | Available comparison op. <op>(*) | Target |
|---|---|---|
| CPUTIME | eq, ne, gt, lt, ge, le | CPU time. <value> must be the format ‘hh:mm:ss’ (hours:minutes:seconds; minutes and seconds are one or two digits). |
| IMAGENAME | eq, ne | Process name (Image name). <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. (It is not a partial match.) |
| MEMUSAGE | eq, ne, gt, lt, ge, le | Memory usage. <value> must be a numeric value (in KiB). |
| MODULES | eq, ne | Modules loaded by the process. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. A single process typically loads multiple modules, but with this filter, the process is included in the results if any of the modules meet the specified conditions. |
| PID | eq, ne, gt, lt, ge, le | Process ID. <value> must be a numeric value. |
| SERVICES | eq, ne | Service name that the process belongs to. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. A single process may belong to multiple services, but with this filter, the process is included in the results if any of the services meet the specified conditions. |
| SESSION | eq, ne, gt, lt, ge, le | Session number. <value> must be a numeric value. |
| STATUS(*) | eq, ne | Process status. <value> must be either of ‘RUNNING’, ‘NOT RESPONDING’, or ‘UNKNOWN’. |
| USERNAME | eq, ne | User name. <value> must be the format ‘[Domain-name\]User-name’. You can use the wildcard ‘*’ at the end of ‘User-name’. |
| WINDOWTITLE(*) | eq, ne | Title name of the main window that the process possesses. <value> must be a name that is an exact match or a string that includes the wildcard ‘*’ at the end. |
- * Comparison ops. are: eq: equal, ne: not equal, gt: greater than, lt: less than, ge: greater than or equal to, le: less than or equal to
- * When targeting processes on a remote computer, ‘STATUS’ and ‘WINDOWTITLE’ cannot be used.
Exit codes
Taskkill returns an exit code of 0 when it terminates successfully. However, if Taskkill cannot terminate the process for some reason (such as being unable to send a termination signal or the process not being found), the exit code will be a value other than 0 (greater than 0). You can use If Errorlevel to perform conditional branching based on whether the exit code is 0 or not.
Samples
Sample 1
taskkill /IM notepad.exe
Terminates the process with the image name (process name) matching ‘notepad.exe’. If Notepad (notepad.exe) receives a termination signal from this command and has unsaved data, it will prompt whether to save the data.
Sample 2
taskkill /F /IM notepad.exe
Forcefully terminates the process with the image name (process name) matching ‘notepad.exe’. Unlike the previous case, it won't display a dialog to save unsaved data even if it exists.
Sample 3
taskkill /T /F /FI "username eq %USERNAME%" /IM cmd.exe
Forcefully terminates the process with the image name ‘cmd.exe’ that is currently being run by the user matching the environment variable ‘USERNAME’, along with its child processes.
Sample 4
taskkill /PID 3456 /PID 3579
Terminates the processes with Process IDs ‘3456’ and ‘3579’ respectively (send termination signals). Each processes of the specified IDs must be currently running.