2
After a reboot on a machine (WS2012-R2), I observed that I could no longer use the "Details" tab in Task Manager to kill a process that I have run at startup. After checking solutions from other similar issues posted in various places, I noted that many were recommending various SysInternals tools. Using these various tools, I still receive an "Access Denied" when trying to kill the process through use of Windows (Task Manager)/SysInternals (Process Explorer) GUIs or command line taskkill/psexec.
For troubleshooting's sake, I am working with something benign like Notepad.exe - here is the output of my efforts with psexec.exe...
C:\Users\adminaccount\Desktop\PSTools>psexec -s taskkill /im Notepad.exe /f
PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
ERROR: The process "notepad.exe" with PID 1968 could not be terminated.
Reason: Access is denied.
taskkill exited on SERVERNAME with error code 1.
C:\Users\adminaccount\Desktop\PSTools>
Oddly, Notepad.exe can be killed without issue via the "Processes" tab of Task Manager.
Upon the aforementioned reboot, it looks like MS15-111 (Elevation of Privilege) and MS15-109 (Remote Code Execution) were installed (based on my corporate IT policy). I will try to remove these, but I am not certain I will be able to easily do so.
I am using an admin account at the time in the course of troubleshooting; this admin account is the one creating the notepad process, so I'm shocked this same account cannot kill the process aside from using the "Processes" tab. In short, this admin account can no longer seem to kill anything if it can't easily do it via the "Processes" tab after the reboot.
I observed this issue trying to kill process started via "Scheduled Tasks". The "Processes" tab approach of Task Manager is not functional for processes started by the system scheduler.
sonnik
Posted 2015-11-25T18:20:12.510
Reputation: 121
2Are you opening the command prompt "As administrator" before trying to run
taskkill? Are the ones you can't kill via the Processes tab all started via the Task Scheduler? Which user/settings did you use in the Task Scheduler to launch the task? Which user name does the Task Manager report these processes are running as? – Ƭᴇcʜιᴇ007 – 2015-11-25T18:33:26.290Opening command prompt as administrator: Yes. Started Via Task Scheduler: Yes, those were the ones that caught my attention, but note that Notepad.exe is being opened via Interactive Windows Explorer. In task scheduler, I start with credentials of the administrative account I was using today. Task Manager reports these as the same administrative user I was logged in as. – sonnik – 2015-11-25T22:05:50.283