How to terminate process using VBScript

Question

I have this VBScript code to terminate one process

  Const strComputer = "." 
  Dim objWMIService, colProcessList
  Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
  For Each objProcess in colProcessList 
    objProcess.Terminate() 
  Next  

It works fine with some processes, but when it comes to any process runs under SYSTEM, it can't stop it.

Is there is anything I need to add to kill the process under SYSTEM?

Answer 1

The way I have gotten this to work in the past is by using PsKill from Microsoft's SysInternals. PsKill can terminate system processes and any processes that are locked.

You need to download the executable and place it in the same directory as the script or add it's path in the WshShell.Exec call. Here's your sample code changed to use PsKill.

Const strComputer = "." 
Set WshShell = CreateObject("WScript.Shell")
Dim objWMIService, colProcessList
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
For Each objProcess in colProcessList 
  WshShell.Exec "PSKill " & objProcess.ProcessId 
Next

Answer 2

Try explicit assert debug privilege {impersonationLevel=impersonate,(debug)}:

Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate,(debug)}!\\.\root\CIMV2")
Set procs = wmi.ExecQuery("SELECT * FROM Win32_Process WHERE Name='SearchIndexer.exe'", , 48)
For Each proc In procs
    proc.Terminate
Next