C:\WINDOWS>TASKKILL /?
TASKKILL
[/S system
[/U username
[/P
[password
]]]] [/F
] [/T
]Description:
This command line tool can be used to end one or more processes.
Processes can be killed by the process id or image name.
Parameter List:
/S system Specifies the remote system to connect to.
/U
[domain\
]user Specifies the user context under which
the command should execute.
/P
[password
] Specifies the password for the given
user context. Prompts for input if omitted.
/F Specifies to forcefully terminate
process(es).
/FI filter Displays a set of tasks that match a
given criteria specified by the filter.
/PID process id Specifies the PID of the process that
has to be terminated.
/IM image name Specifies the image name of the process
that has to be terminated. Wildcard '*'
can be used to specify all image names.
/T Tree kill: terminates the specified process
and any child processes which were started by it.
/? Displays this help/usage.
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------
STATUS eq, ne RUNNING | NOT RESPONDING
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number.
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in
[domain\
]user
format
MODULES eq, ne DLL name
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
NOTE: Wildcard '*' for the /IM switch is accepted only with filters.
NOTE: Termination of remote processes will always be done forcefully
irrespective of whether /F option is specified or not.
Examples:
TASKKILL /S system /F /IM notepad.exe /T
TASKKILL /PID 1230 /PID 1241 /PID 1253 /T
TASKKILL /F /IM notepad.exe /IM mspaint.exe
TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*"
TASKKILL /F /FI "USERNAME eq NT AUTHORITY\SYSTEM" /IM notepad.exe
TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM *
TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"
EXAMPLE
Kill Procesid
D:\SoftwareOK>tasklist
Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung
========================= ===== ================ ========== ===============
System Idle Process 0 Console 0 28 K
System 4 Console 0 240 K
SMSS.EXE 656 Console 0 388 K
CSRSS.EXE 708 Console 0 5.024 K
WINLOGON.EXE 732 Console 0 1.568 K
SERVICES.EXE 776 Console 0 3.420 K
LSASS.EXE 788 Console 0 1.532 K
SVCHOST.EXE 960 Console 0 4.928 K
SVCHOST.EXE 1036 Console 0 4.392 K
SVCHOST.EXE 1156 Console 0 23.528 K
SVCHOST.EXE 1248 Console 0 3.600 K
SVCHOST.EXE 1312 Console 0 7.372 K
LEXBCES.EXE 1484 Console 0 3.608 K
LEXPPS.EXE 1520 Console 0 3.436 K
SPOOLSV.EXE 1528 Console 0 6.236 K
EXPLORER.EXE 1892 Console 0 36.376 K
LXCZBMGR.EXE 192 Console 0 2.600 K
CTFMON.EXE 216 Console 0 3.884 K
LXCZBMON.EXE 228 Console 0 2.316 K
MagicDisc.exe 524 Console 0 1.240 K
INETINFO.EXE 1412 Console 0 9.680 K
NVSVC32.EXE 1436 Console 0 3.792 K
SVCHOST.EXE 1772 Console 0 4.812 K
ALG.EXE 2708 Console 0 3.632 K
SVCHOST.EXE 3224 Console 0 3.504 K
IEXPLORE.EXE 1804 Console 0 45.884 K
Ped3.exe 436 Console 0 24.376 K
IEXPLORE.EXE 300 Console 0 48.352 K
IEXPLORE.EXE 3276 Console 0 42.144 K
MSDEV.EXE 3860 Console 0 15.392 K
IEXPLORE.EXE 3736 Console 0 23.868 K
IEXPLORE.EXE 1760 Console 0 23.724 K
MSIMN.EXE 4080 Console 0 20.560 K
IEXPLORE.EXE 2624 Console 0 27.380 K
WMIPRVSE.EXE 3484 Console 0 5.988 K
ColorConsole.exe 2292 Console 0 3.096 K
cmd.exe 2232 Console 0 2.708 K
tasklist.exe 3084 Console 0 4.524 K
Kill the process with PID 2292
D:\SoftwareOK>taskkill /pid 2292
Kill the process with PID 2292 + PID 2232
D:\SoftwareOK>taskkill /pid 2292 /pid 2232
taskkill /pid 1230 /pid 1241 /pid 1253
taskkill /f /fi "USERNAME eq NT AUTHORITY\SYSTEM" /im notepad.exe
Kill notepad.exe
D:\SoftwareOK>taskkill /IM notepad.exe /F
kill notepad.exe on network pc "pc4"
D:\SoftwareOK>taskkill /s pc4 /f /im notepad.exe
C:\WINDOWS>TASKLIST /?
TASKLIST
[/S system
[/U username
[/P
[password
]]]] [/M
[module
] | /SVC | /V
] [/FI filter
] [/FO format
] [/NH
]Description:
This command line tool displays a list of application(s) and
associated task(s)/process(es) currently running on either a local or
remote system.
Parameter List:
/S system Specifies the remote system to connect to.
/U
[domain\
]user Specifies the user context under which
the command should execute.
/P
[password
] Specifies the password for the given
user context. Prompts for input if omitted.
/M
[module
] Lists all tasks that have DLL modules loaded
in them that match the given pattern name.
If the module name is not specified,
displays all modules loaded by each task.
/SVC Displays services in each process.
/V Specifies that the verbose information
is to be displayed.
/FI filter Displays a set of tasks that match a
given criteria specified by the filter.
/FO format Specifies the output format.
Valid values: "TABLE", "LIST", "CSV".
/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for "TABLE" and "CSV" formats.
/? Displays this help/usage.
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------
STATUS eq, ne RUNNING | NOT RESPONDING
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in
[domain\
]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name
Examples:
TASKLIST
TASKLIST /M
TASKLIST /V
TASKLIST /SVC
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"
C:\WINDOWS>TFTP /?
Transfers files to and from a remote computer running the TFTP service.
TFTP
[-i
] host
[GET | PUT
] source
[destination
] -i Specifies binary image transfer mode (also called
octet). In binary image mode the file is moved
literally, byte by byte. Use this mode when
transferring binary files.
host Specifies the local or remote host.
GET Transfers the file destination on the remote host to
the file source on the local host.
PUT Transfers the file source on the local host to
the file destination on the remote host.
source Specifies the file to transfer.
destination Specifies where to transfer the file.
