Tasklist and Tskill manage Windows system process

I believe everyone has the habit of using the command line (CMD) to solve the problem, at least I feel that I can't get away from Windows PE when dealing with Windows system failure. Today I want to introduce two A very useful command: Tasklist and Tskill.

Command: Tasklist

Function: The command is used to display all processes running on a local or remote computer, and can monitor the user's operation.

Command Format:

Tasklist [/S system [/U username [/P [password]]]] [/M [module] |  /SVC |  /V] [/FI filter] [/FO format] [/NH]

Parameter Meaning

/S system Specifies the remote system to connect to.

/U [domain\\]user Specifies which user to use to execute this command.

/P [password] Specifies the password for the specified user.

/M [module] Lists all processes that call the specified DLL module. If no module name is specified, all modules loaded by each process are displayed.

/SVC displays the services in each process.

/V Show details.

Instance Analysis:

If we just look at the local host process information, we can directly enter the command. The following example is to remotely view the time history information of a host in the intranet from the client.

If we have a server:

Intranet address: 192.168.0.1,

Administrator account: administrator

Administrator password: password

We need to enter in the CMD window:

Tasklist /s 192.168.0.1 /u administrator /p password

This command allows us to easily view the operation of the remote host. Of course, the premise is to ensure that the RPC service starts normally.

Command: tskill

Function:

to turn off the process Format:

TSKILL processid |  Processname [/SERVER:servername] [/ID:sessionid |  /A] [/V]

Parameter Meaning

processid The Process ID of the process to end.

processname The name of the process to end.

/SERVER:servername The server with processID (the default is the current value).

When using the process name and /SERVER, you must specify

/ID or /A

/ID:sessionid to end the process running under the specified session.

/A Ends the process running under all sessions.

/V Displays information about the operation being performed.

The usage of this Skill is very simple. Simply enter the Tskill image name or PID.

Occasionally encounter a process that Task can not end, you can also try the Ntsd command,

The format is: ntsd -cq -pn {process name}

Parameter meaning: < Br>

-c means to execute the debug command;

q means to exit after execution;

-p means that the PID corresponding to the process you want to end is followed; Br>

-pn means that the name of the process you want to end is followed by