Kill a process which says "Access denied"

178

42

I have a process that I can't kill with either Task Manager or Process Explorer - I get the error "Access denied". The process isn't a Windows executable.

How can I kill it? Is there some tool I could use to override this protection?

I'm using Windows 7, 64-bit edition.

Tony_Henrich

Posted 2010-02-15T06:45:04.820

Reputation: 9 154

5Would it be necessary to ask a separate question to ask why as an administrator of my own system I am "not allwoed" to kill a process on my own system? I could see a "warning" at most: "hey, if you kill this process, this, this and this will happen, would you still like to continue?" – IT Bear – 2014-09-21T05:19:20.200

would it be asked too much telling us which process you want to terminate? – None – 2010-02-17T22:52:37.823

My Comodo firewall – Tony_Henrich – 2010-02-20T04:52:24.207

@TBohne - taskkill /t /f /pid 17888 : ERROR: The process with PID 17888 (child process of PID 17880) could not be terminated. Reason: There is no running instance of the task. :( But it is the parent 17880 that is not running. – Jesse Chisholm – 2015-06-07T16:43:53.580

1For what it's worth, I used procexplorer to look at the task and I saw that the parent task was explorer.exe. I killed explorer.exe and then the task went away. Nice and simple in the end. I'd put this up as an answer, but it's not letting me for some reason. – Eli Gassert – 2015-12-01T08:15:28.783

@Tony_Henrich: Why do you want to kill the process? – unforgettableidSupportsMonica – 2017-03-20T12:08:33.623

I don't have enough reputation to answer, but here's another idea that worked for me: use ollydbg or another debugger, attach to the process and then stop debugging. Not the prettiest, but it seems to get the job done. – bruceceng – 2019-04-12T14:26:16.563

4run command prompt as administrator. use taskkill /im <your process.exe> /f to end the process – tumchaaditya – 2012-06-15T12:08:17.010

2@tumchaaditya: taskkill /im <process>: The process can only be terminated forcefully. taskkill /F /im <process>: There is no running intance of the task. :( TaskMgr as admin also can't kill it: Access is denied. – Mooing Duck – 2014-05-16T22:38:58.817

Answers

100

Kill a protected process?

http://processhacker.sourceforge.net/index.php

Works on Windows Server without admin rights! Yammie! :)

Greatz

Posted 2010-02-15T06:45:04.820

Reputation: 1 009

1Process Hacker won't kill the Symantec DLP process [edpa.exe] – PeterX – 2014-07-02T01:50:45.637

1It may also be possible to simply start Process Explorer as an administrator in order to gain rights to kill such processes. Worked for me anyway. – bames53 – 2015-03-21T05:45:00.020

1Sucessfully kills mcshield.exe (when running as administrator). mcshield.exe restarts immediately but without the murderous 100% cpu behaviour(which is the reason it has to be killed like twice a week). Never managed this with process explorer. – Tewr – 2016-04-12T12:41:15.843

1I'm still getting an error with Process Hacker: "Unable to terminate ... An attempt was made to access and exiting process." – Aaron Franke – 2016-10-11T04:43:40.343

@thomas88: Please see "How can I kill an unkillable process?" and my comment on that question.

– unforgettableidSupportsMonica – 2017-03-20T12:14:17.017

In my case it didn't work. But at least got the process id. It was access denied of an already killed process. Closed visual studio and the process ended. I guess got a rare glitch in which visual studio didn't completely stopped the process I was debugging when calling stop process from the debugger. – rxantos – 2018-04-06T17:48:07.023

5Thanks! I was able to kill the "access denied" process with process hacker, this is great advice, this should be the chosen answer for this question. Thanks for also letting me know about this great software, I was unhappy with process explorer for a long time, now I've found a great replacement. – KoKo – 2012-10-26T18:52:56.667

17Did not kill my process, but at least it gave a reason except "Access Denied" (which Task Manager and Process Explorer dit not: Unable to terminate OUTLOOK.EXE (PID 7588): An attempt was made to access an exiting process. – thomasa88 – 2013-08-19T15:00:08.197

17

  1. Download "Process Explorer".
  2. On the process properties view, select the security tab.
  3. Press the permissions button.
  4. Press the advanced button.
  5. If necessary, add yourself or a group you belong to.
  6. Edit your permissions to include "Terminate". (you will need to already have the "Change Permissions" permission, or you are out of luck.)

alt text

In general, the need to kill tasks means somebody is not doing something correctly. I'd look for another solution to whatever problem you are facing. Perhaps if you told us more about that we could find a more graceful option?

DanO

Posted 2010-02-15T06:45:04.820

Reputation: 2 494

2My "Permissions" button isn't grayed out, but the dialog that comes up (in Windows-8) doesn't have all those available. Just 'Full', 'Read', 'Write' and 'Special'. – Jesse Chisholm – 2015-06-08T01:38:40.577

1ockquote>

the need to kill tasks means somebody is not doing something correctly. Yeah, namely the programmers who wrote the damn thing.

– Kaz – 2019-02-05T01:05:08.093

@cheeesus do you still have that problem, or did you fixed it, can you tell how? – Fadhil – 2019-11-02T17:47:48.443

@Fadhil I think I haven't had this problem in a while. I didn't fix it, it somehow went away. Maybe I'm using other tools. – cheesus says stop firing mods – 2019-11-02T19:02:57.013

9Permissions button is grayed out, even though I'm an administrator and I'm running Process Explorer elevated. – cheesus says stop firing mods – 2014-02-20T07:57:37.483

2This is not work for me to kill AVGUI.exe process but i did it using Process Hacker – Rikin Patel – 2014-03-04T09:18:56.240

10

The taskkill and powershell (kill) methods didn't work for me; it still said Access Denied.

I had better luck with this:

wmic process where name='myprocessname.exe' delete

twasbrillig

Posted 2010-02-15T06:45:04.820

Reputation: 377

10"Access denied" using this method too. – Jonas Äppelgran – 2017-04-22T18:54:29.180

1This is working like a charm. – Hamza Anis – 2018-03-23T10:56:49.743

7I had to type wmic process where "name='myprocessname.exe'" delete. Otherwise I would get an Invalid query error. At the end I still get an access denied error. – Memet Olsen – 2018-07-30T07:30:24.387

1Instance deletion successful. and yet it remains :( – ken – 2019-10-22T02:39:18.333

@MemetOlsen An alternative syntax is processid=1234. However, I also still get “ERROR: Description = Access denied”. – binki – 2020-02-26T14:17:41.123

10

None of the mentioned above tools helped in my case.

See https://blogs.technet.microsoft.com/markrussinovich/2005/08/17/unkillable-processes/.

Mark Russinovich shows there that there are cases when process can be almost impossible to kill.

Vadzim

Posted 2010-02-15T06:45:04.820

Reputation: 974

8

You just need to give process explorer administrative privileges, no need of adding any account or not (if you're already an admin). There is no need of telling which processes to terminate or not or installing any other process manager (even I love Process Explorer).

Either:

  • Right-click and "Run as administrator"

  • Go to properties and then compatibility and select "Run as administrator"

Now it'll never say access denied.

Kartik Anand

Posted 2010-02-15T06:45:04.820

Reputation: 209

1Cannot shutdown MsMpEng this way in Windows 7/8/10. – user2864740 – 2018-05-21T21:13:44.333

22Um Yea, it can still say "access denied". If the process is started with security flags that alter the terminate permission in the process ACL, you won't be able to terminate it until you can change that permissions on the process. Antivirus process often do this on purpose (mostly just to be annoying), as it wouldn't be hard for malware to get around this usually. ala processhacker. – DanO – 2012-08-16T17:16:51.050

6does not work for me. – peter – 2014-04-14T09:20:22.503

6

Are you on a privileged account? Generally when you receive the "Access Denied" error even on an account with higher access, it is usually because you are trying to kill a service which is critical to the system's operation. Some applications on the other hand, such as VMWare, also implement their own "process protection", even for processes which are not vital to system operation.

If you are on a privileged account, you can give Sysinternals PsKill a shot, I've used it in the past to kill processes that gave me similar error messages. Be careful what processes you're killing though, it may make your system unstable.

John T

Posted 2010-02-15T06:45:04.820

Reputation: 149 037

After running this, it told me it worked even though it didn't.. – Akaisteph7 – 2020-02-28T22:29:39.350

If i am taking down my processes, will it be still unstable ? – Big Leonardo – 2012-01-24T13:13:53.163

However pskill can't kill any process. In my case it can't kill nginx wrapper that is not critical process. It's a service but not a usual process. – sergzach – 2012-02-19T11:42:50.817

4

Not sure the reason but using Sysinternal's Process Explorer and clicking at "Show Details for All Processes" from File menu solved the issue and allowed me to kill the service. Perhaps it switches to Admin mode only then.

Naveed Ul Islam

Posted 2010-02-15T06:45:04.820

Reputation: 41

It does exactly that. That option makes it re-launch itself with elevated permissions (if you have them). – DanO – 2018-05-31T18:32:31.873

3

  1. Open Task Manager. Go to the Process Tab.
  2. Right click on the process and click on Properties.
  3. Click on the Security Tab and then click on Edit.
  4. On the Permissions window click on the Add button to open the Select Users Group or Groups window.
  5. On the Select Users or Groups window you can enter the usernames of the accounts you want apply the restrictions.
  6. Select your username and set the permissions to deny/allow by checking the checkbox under the deny/allow option.
  7. Click on Apply and then Ok.

via

Iain

Posted 2010-02-15T06:45:04.820

Reputation: 4 399

1I am an admin and I have full control. – Tony_Henrich – 2010-02-20T04:56:11.670

It doesn't work for me: Unable to save permission changes on ... Access is denied. – ROMANIA_engineer – 2015-11-27T08:03:05.617

1Changed the permission, did not work – John Demetriou – 2016-02-09T09:12:02.307

3Erm, what? This would change the permissions of the excutable file, not the running process instance, so it seems totally irrelevant. – underscore_d – 2017-04-13T12:48:21.280

Access denied.. – pabrams – 2018-06-29T14:18:15.453

15Usually when you can't kill a process you can't change its permissions either – skan – 2012-01-10T00:43:48.397

Great for processes but what is for services? – sergzach – 2012-02-19T11:45:41.030

1Hmm I tried it, but when I pressed Apply, it told me "ACCESS DENIED" – Jet – 2013-06-24T10:16:53.920

1

It is also possible to kill commands using the Windows PowerShell, use get-process to list the processes running and then use stop-process with the ID of the task to kill it. Stop-Process.

get-process Unkillable.exe
stop-process 1234

You may find you need to launch the Windows PowerShell specifically as an administrator.

Richard Lucas

Posted 2010-02-15T06:45:04.820

Reputation: 2 744

As of late 2019, this method and every other mentioned here fails to kill (or allow me to query the handles or anything else of) MsMpEng.exe, for one: I have no controlling access to this process, which I don't much like. Previously, if I saw the thing churning when I didn't want it to, process hacker would kill it. Now, nothing will. Have microsoft done something to this program to make it unkillable? Is there any way around this now? – Luther – 2020-01-02T08:47:53.000

1

Try using APT(Advanced Process Terminator), kills any process easily.

HackToHell

Posted 2010-02-15T06:45:04.820

Reputation: 6 162

Asked: 2010-02-15T06:45:04.820

Viewed: 697 898 times

Active: 2019-04-05T17:49:55.150