I wrote Task Manager and I just remembered something

Re:I wrote Task Manager and I just remembered something by voltagex_ on Monday May 25, 2020 @06:44PM (#23305688)

"- There should be nothing that TaskMgr can't kill - it will even escalate privilege and (if you have it) enable debug privilege to attach to and kill apps that way if needed. If TM can't kill it, you've got a kernel problem."

I've seen stuff that taskmgr can't kill - I haven't ever seen it use any debugging privileges that I know of.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by toyg on Tuesday May 26, 2020 @03:48AM (#23308465)

I suspect the author had moved on from MS by the time XPSP2 dramatically restricted security privileges in Windows.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by CawCawCaw on Tuesday May 26, 2020 @12:12AM (#23307341)

I would guess that protected processes with at least Tcb level (which denies PROCESS_TERMINATE) can't be killed in this way.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by muststopmyths on Monday May 25, 2020 @08:13PM (#23306205)

like he said, kernel problem. Most likely a driver holding on to a handle opened by a process by not cancelling I/O properly. to my recollection the most common case, but could be similar other reasons.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by asveikau on Monday May 25, 2020 @08:47PM (#23306373)

I think it also used to be able to kill msmpeng.exe but it now fails with access denied. I assumed it was intentional because they don't want to kill antivirus. But it is a CPU hog, often at critical times, so I used to find myself killing it a lot in past releases.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by KiwiJohnno on Tuesday May 26, 2020 @02:19AM (#23307998)

In windows processes have an access control list, just like file permissions. MsMpEng.exe (and other sometimes other critical system processes and antivirus scanners etc) can't be killed because only system has permission, not administrators. Process Explorer allows you to view and modify a process access control list (if you have permission).

If you use psexec to run process explorer as system, then you can get into the access control list of these processes and add permission for administrator (or just kill them from there...)

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by asveikau on Wednesday May 27, 2020 @12:08AM (#23319299)

I am ex msft. I have written windows code in kernel mode. I know that there are acls. I know about psexec too. I was not talking about any of that, but Task Manager as this thread was about.

Personally if I were killing with psexec I would try invoking taskkill.exe.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by KiwiJohnno on Wednesday May 27, 2020 @01:42AM (#23319718)

Ah, ok, sorry I was just trying to be helpful, I wasn't trying to teach you to suck eggs :)

But my main point was (that I implied, but I didn't say) is yes, I remember killing off early versions of microsoft security essentials (when that was its name) with task manager too. Logically, back then the process didn't have a restricted ACL, but it now does.

I didn't actually know you could specify the system user when killing a process with taskkill, thanks

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by randkyp on Monday May 25, 2020 @09:30PM (#23306595)

I've had better luck killing such "unkillable" processes with taskkill.exe /f /im program.exe instead.

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by RMPR on Thursday May 28, 2020 @07:20AM (#23336002)

You forgot sudo

[ Parent | on HN ]

Re:I wrote Task Manager and I just remembered something by brynjolf on Monday May 25, 2020 @08:47PM (#23306375)

Suspended apps don't show up and have to be killed through wmic sometimes

[ Parent | on HN ]