10

On Microsoft Technet I can read that taskkill has a /f parameter to kill a process forcefully. I wonder what this does internally, to understand the impact of such an action.

taskkill (without /f) does not simply send a WM_CLOSE message to the process, otherwise my application would ask whether or not to save the open documents. This makes me assume that it already operates on a TerminateProcess (MSDN) level. However, TerminateProcess does not have a parameter for forcing a kill.

So, what do taskkill and taskkill /f do internally?

I read the related question Difference between C# Process.Kill() and Taskkill but it does not have an answer.

Community
  • 1
  • 1
Thomas Weller
  • 55,411
  • 20
  • 125
  • 222

1 Answers1

6

Most likely taskkill /f uses TerminateProcess, where as taskkill without /f just posts a WM_QUIT message (not WM_CLOSE). The docs says that TerminateProcess unconditionally kills the process.

You can try following experiments:

  1. Launch notepad.exe and type a few chars in the notpad window
  2. Type taskkill /f /im notepad.exe. Notepad will quit immediately

Now do this:

  1. Launch notepad.exe and type a few chars in the notpad window
  2. Type taskkill /im notepad.exe. Notepad won't quit immediately but it will quit ask if you want to save modifiactions.
Jabberwocky
  • 48,281
  • 17
  • 65
  • 115
  • 1
    Ok, so in the normal case, my application should be able to process all pending Windows Messages but in the `/f` case it can't. Therefore the normal case might not terminate applications that are in "Not Responding" state since "Not responding" means that Windows has detected that the application does not process messages any more. – Thomas Weller Sep 02 '15 at 07:20
  • 1
    A `WM_QUIT` message would be unlikely to cause Notepad to show its "Save modifications?" dialog; by the time `WM_QUIT` is received your main window is usually gone. – Jonathan Potter Sep 02 '15 at 07:33
  • 2
    It is *not* `WM_QUIT`, but `WM_CLOSE`, at least on Windows 10, as has been mentioned in a deleted answer. – Martin Ba Apr 11 '18 at 10:42
  • Definitively WM_CLOSE is used in Windows 10. It isn't WM_QUIT that is sent. – xMRi Apr 18 '23 at 11:26