Kill a process which says "Access denied"

Question

I have a process that I can't kill with either Task Manager or Process Explorer - I get the error "Access denied". The process isn't a Windows executable.

How can I kill it? Is there some tool I could use to override this protection?

I'm using Windows 7, 64-bit edition.

would it be asked too much telling us which process you want to terminate? — , Feb 17 '10 at 22:52
run command prompt as administrator. use taskkill /im /f to end the process — tumchaaditya, Jun 15 '12 at 12:08
@tumchaaditya: `taskkill /im `: `The process can only be terminated forcefully`. `taskkill /F /im `: `There is no running intance of the task`. :( TaskMgr as admin also can't kill it: `Access is denied`. — Mooing Duck, May 16 '14 at 22:38
Would it be necessary to ask a separate question to ask why as an administrator of my own system I am *"not allwoed"* to kill a process on my own system? I could see a "warning" at most: "hey, if you kill this process, this, this and this will happen, would you still like to continue?" — IT Bear, Sep 21 '14 at 05:19
@TBohne - `taskkill /t /f /pid 17888` : `ERROR: The process with PID 17888 (child process of PID 17880) could not be terminated. Reason: There is no running instance of the task.` :( But it is the parent 17880 that is not running. — Jesse Chisholm, Jun 07 '15 at 16:43
For what it's worth, I used `procexplorer` to look at the task and I saw that the parent task was `explorer.exe`. I killed `explorer.exe` and then the task went away. Nice and simple in the end. I'd put this up as an answer, but it's not letting me for some reason. — Eli Gassert, Dec 01 '15 at 08:15
I don't have enough reputation to answer, but here's another idea that worked for me: use ollydbg or another debugger, attach to the process and then stop debugging. Not the prettiest, but it seems to get the job done. — bruceceng, Apr 12 '19 at 14:26
It's very annoying, but I get this all the time when using PowerShell 7 remote file read/writes on remote machines: [ForEach-Object -ThrottleLimit 1000 -Parallel { }]. Most of the time it works great, but other times it locks up and there is no way to terminate pwsh.exe without a reboot when this happens. — Tolga, Jul 03 '23 at 12:55

score 121 · Answer 1 · answered Apr 10 '12 at 14:38

121

Kill a protected process?

http://processhacker.sourceforge.net/index.php

Works on Windows Server without admin rights! Yammie! :)

answered Apr 10 '12 at 14:38

Greatz

1,227
1
8
2

7

Thanks! I was able to kill the "access denied" process with process hacker, this is great advice, this should be the chosen answer for this question. Thanks for also letting me know about this great software, I was unhappy with process explorer for a long time, now I've found a great replacement. – KoKo Oct 26 '12 at 18:52
30

Did not kill my process, but at least it gave a reason except "Access Denied" (which Task Manager and Process Explorer dit not: Unable to terminate OUTLOOK.EXE (PID 7588): An attempt was made to access an exiting process. – thomasa88 Aug 19 '13 at 15:00
3

Process Hacker won't kill the Symantec DLP process [edpa.exe] – PeterX Jul 02 '14 at 01:50
1

It may also be possible to simply start Process Explorer as an administrator in order to gain rights to kill such processes. Worked for me anyway. – bames53 Mar 21 '15 at 05:45
1

Sucessfully kills mcshield.exe (when running as administrator). mcshield.exe restarts immediately but without the murderous 100% cpu behaviour(which is the reason it has to be killed like twice a week). Never managed this with process explorer. – Tewr Apr 12 '16 at 12:41
7

I'm still getting an error with Process Hacker: "Unable to terminate ... An attempt was made to access and exiting process." – Aaron Franke Oct 11 '16 at 04:43
@thomas88: Please see ["How can I kill an unkillable process?"](https://superuser.com/questions/136272/how-can-i-kill-an-unkillable-process) and [my comment on that question](https://superuser.com/questions/136272/how-can-i-kill-an-unkillable-process#comment1727588_136272). – unforgettableidSupportsMonica Mar 20 '17 at 12:14
1

In my case it didn't work. But at least got the process id. It was access denied of an already killed process. Closed visual studio and the process ended. I guess got a rare glitch in which visual studio didn't completely stopped the process I was debugging when calling stop process from the debugger. – rxantos Apr 06 '18 at 17:48
This finally worked for me: Open Process Hacker -> right click -> Misc -> Terminator -> check M2 option -> run – Thomas Orlita Mar 08 '20 at 09:58
@thomasa88 same is the case with me, what do we have to do ? – anonymous38653 May 22 '20 at 10:08
Thank you! Killed MsMpEng.exe succesfully after 2 attempts. – Junyan Xu Jan 22 '21 at 02:21

twasbrillig · Answer 2 · 2019-04-05T17:49:55.150

23

The taskkill and powershell (kill) methods didn't work for me; it still said Access Denied.

I had better luck with this:

wmic process where name='myprocessname.exe' delete

edited Apr 05 '19 at 17:49

answered Aug 04 '16 at 03:03

twasbrillig

633
9
14

37

"Access denied" using this method too. – Jonas Äppelgran Apr 22 '17 at 18:54
1

This is working like a charm. – Hamza Anis Mar 23 '18 at 10:56
15

I had to type `wmic process where "name='myprocessname.exe'" delete`. Otherwise I would get an `Invalid query` error. At the end I still get an access denied error. – Memet Olsen Jul 30 '18 at 07:30
1

`Instance deletion successful.` and yet it remains :( – ken Oct 22 '19 at 02:39
4

@MemetOlsen An alternative syntax is `processid=1234`. However, I also still get “ERROR: Description = Access denied”. – binki Feb 26 '20 at 14:17
This worked for me as well! – Adam Arold Sep 02 '20 at 08:06
I got `Description = Invalid query` when tried `wmic process where name="avp.exe" delete`. Change name=.... to `pid=5108` not working too (5108 is pid of avp - kaspersky) – Pham X. Bach Mar 21 '22 at 02:16

score 21 · Answer 3 · edited Oct 23 '18 at 03:41

21

Download "Process Explorer".
On the process properties view, select the security tab.
Press the permissions button.
Press the advanced button.
If necessary, add yourself or a group you belong to.
Edit your permissions to include "Terminate". (you will need to already have the "Change Permissions" permission, or you are out of luck.)

alt text

In general, the need to kill tasks means somebody is not doing something correctly. I'd look for another solution to whatever problem you are facing. Perhaps if you told us more about that we could find a more graceful option?

edited Oct 23 '18 at 03:41

Pang

937
1
9
12

answered Feb 17 '10 at 22:09

DanO

2,790
1
18
19

14

Permissions button is grayed out, even though I'm an administrator and I'm running Process Explorer elevated. – Jonas Sourlier Feb 20 '14 at 07:57
2

This is not work for me to kill AVGUI.exe process but i did it using Process Hacker – Rikin Patel Mar 04 '14 at 09:18
2

My "Permissions" button isn't grayed out, but the dialog that comes up (in Windows-8) doesn't have all those available. Just 'Full', 'Read', 'Write' and 'Special'. – Jesse Chisholm Jun 08 '15 at 01:38
3

> *the need to kill tasks means somebody is not doing something correctly.* Yeah, namely the programmers who wrote the damn thing. – Kaz Feb 05 '19 at 01:05
@cheeesus do you still have that problem, or did you fixed it, can you tell how? – Fadhil Ahmad Nov 02 '19 at 17:47
@Fadhil I think I haven't had this problem in a while. I didn't fix it, it somehow went away. Maybe I'm using other tools. – Jonas Sourlier Nov 02 '19 at 19:02
1

This solution did not work for me. My account has the kill permission, but the process cannot be killed. – needfulthing Jul 09 '20 at 10:16

Vadzim · Answer 4 · 2020-11-13T13:52:53.317

16

None of the mentioned above tools helped in my case.

See https://techcommunity.microsoft.com/t5/windows-blog-archive/unkillable-processes/ba-p/723389.

Mark Russinovich shows there that there are cases when process can be almost impossible to kill.

edited Nov 13 '20 at 13:52

answered May 08 '13 at 06:24

Vadzim

1,270
14
18

Link is broken . – tchelidze Nov 13 '20 at 12:29
1

@tchelidze, fixed – Vadzim Nov 13 '20 at 13:53

score 7 · Answer 5 · answered Feb 15 '10 at 07:06

7

Are you on a privileged account? Generally when you receive the "Access Denied" error even on an account with higher access, it is usually because you are trying to kill a service which is critical to the system's operation. Some applications on the other hand, such as VMWare, also implement their own "process protection", even for processes which are not vital to system operation.

If you are on a privileged account, you can give Sysinternals PsKill a shot, I've used it in the past to kill processes that gave me similar error messages. Be careful what processes you're killing though, it may make your system unstable.

answered Feb 15 '10 at 07:06

John T

163,373
27
341
348

If i am taking down my processes, will it be still unstable ? – Big Leonardo Jan 24 '12 at 13:13
However pskill can't kill any process. In my case it can't kill nginx wrapper that is not critical process. It's a service but not a usual process. – sergzach Feb 19 '12 at 11:42
After running this, it told me it worked even though it didn't.. – Akaisteph7 Feb 28 '20 at 22:29

score 7 · Answer 6 · edited Jun 15 '12 at 14:04

7

You just need to give process explorer administrative privileges, no need of adding any account or not (if you're already an admin). There is no need of telling which processes to terminate or not or installing any other process manager (even I love Process Explorer).

Either:

Right-click and "Run as administrator"
Go to properties and then compatibility and select "Run as administrator"

Now it'll never say access denied.

edited Jun 15 '12 at 14:04

random

14,638
9
54
58

answered May 07 '12 at 17:51

Kartik Anand

231
2
10

33

Um Yea, it can still say "access denied". If the process is started with security flags that alter the terminate permission in the process ACL, you won't be able to terminate it until you can change that permissions on the process. Antivirus process often do this on purpose (mostly just to be annoying), as it wouldn't be hard for malware to get around this usually. ala processhacker. – DanO Aug 16 '12 at 17:16
9

does not work for me. – peter Apr 14 '14 at 09:20
4

Cannot shutdown MsMpEng this way in Windows 7/8/10. – user2864740 May 21 '18 at 21:13

score 4 · Answer 7 · answered Dec 18 '12 at 18:41

4

Not sure the reason but using Sysinternal's Process Explorer and clicking at "Show Details for All Processes" from File menu solved the issue and allowed me to kill the service. Perhaps it switches to Admin mode only then.

answered Dec 18 '12 at 18:41

Naveed Ul Islam

41
1

It does exactly that. That option makes it re-launch itself with elevated permissions (if you have them). – DanO May 31 '18 at 18:32

score 2 · Answer 8 · answered Feb 15 '10 at 09:05

2

Open Task Manager. Go to the Process Tab.
Right click on the process and click on Properties.
Click on the Security Tab and then click on Edit.
On the Permissions window click on the Add button to open the Select Users Group or Groups window.
On the Select Users or Groups window you can enter the usernames of the accounts you want apply the restrictions.
Select your username and set the permissions to deny/allow by checking the checkbox under the deny/allow option.
Click on Apply and then Ok.

via

answered Feb 15 '10 at 09:05

Iain

4,718
2
27
41

1

I am an admin and I have full control. – Tony_Henrich Feb 20 '10 at 04:56
20

Usually when you can't kill a process you can't change its permissions either – skan Jan 10 '12 at 00:43
Great for processes but what is for services? – sergzach Feb 19 '12 at 11:45
3

Hmm I tried it, but when I pressed Apply, it told me "ACCESS DENIED" – Jet Jun 24 '13 at 10:16
It doesn't work for me: `Unable to save permission changes on ... Access is denied.` – ROMANIA_engineer Nov 27 '15 at 08:03
1

Changed the permission, did not work – John Demetriou Feb 09 '16 at 09:12
4

Erm, what? This would change the permissions of the excutable file, not the running process instance, so it seems totally irrelevant. – underscore_d Apr 13 '17 at 12:48
Access denied.. – pabrams Jun 29 '18 at 14:18

score 2 · Answer 9 · edited Apr 04 '19 at 04:44

2

It is also possible to kill commands using the Windows PowerShell, use get-process to list the processes running and then use stop-process with the ID of the task to kill it. Stop-Process.

get-process Unkillable.exe
stop-process 1234

You may find you need to launch the Windows PowerShell specifically as an administrator.

edited Apr 04 '19 at 04:44

TankorSmash

284
2
13

answered Feb 15 '10 at 11:54

Richard Lucas

2,838
21
23

6

As of late 2019, this method and every other mentioned here fails to kill (or allow me to query the handles or anything else of) MsMpEng.exe, for one: I have no controlling access to this process, which I don't much like. Previously, if I saw the thing churning when I didn't want it to, process hacker would kill it. Now, nothing will. Have microsoft done something to this program to make it unkillable? Is there any way around this now? – Luther Jan 02 '20 at 08:47

score 2 · Answer 10 · answered Apr 10 '12 at 15:50

2

Try using APT(Advanced Process Terminator), kills any process easily.

answered Apr 10 '12 at 15:50

HackToHell

6,328
3
38
62

tried ... no dice – Erik Aronesty Sep 15 '20 at 23:06

score 0 · Answer 11 · answered Aug 15 '23 at 13:49

0

you need to open a shell with system permissions to kill the process! Sysinternal's psexec is your friend:

psexec -s taskkill /im MyTask.exe /f

or if the process is acually a service:

psexec -s sc stop MyService

answered Aug 15 '23 at 13:49

Falco Alexander

1,185
2
15
25

Kill a process which says "Access denied"

11 Answers11

Linked