Vista - Cancel Process that is a System Task

I'm using VBS trying to cancel a process who's user is SYSTEM. The code
below work just fine for any process that I've started, but if I try one that
has a user of SYSTEM it doesn't work.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = ""MqrServerMon.exe""")

For Each objProcess in colProcessList
objProcess.Terminate()
Next
WSCript.Echo "Just killed process " _
& " on " & strComputer

This is pretty standard code to do this, but it just does not seem to be
working for the system users.

Thanks for any suggestions.
Rodney

"Installer" <Installer@xxxxxx> wrote in message
news:29729467-CD51-4EA5-AD1C-8D7B892CE174@xxxxxxCan you kill the task with taskkill.exe? If you can't the you'll probably
see a screen message that tells you the reason.

Yes, I have no problem with taskkill. My problem with using taskkill from
the shell command is that it ignores my vbHide parameter and I get the pop-up
cmd prompt. This looks really awful during an install so I was trying to get
everything into vbscript.

Thanks for the idea.

"Pegasus (MVP)" wrote:

"Installer" <Installer@xxxxxx> wrote in message
news:1D0FF693-FDCD-431B-9428-981DE417C8B0@xxxxxxWith "taskkill" I intended to give some pointers only. However, I
subsequently found that I could not terminate System tasks either when using
your code. On the other hand I could use the "taskkill" work-around without
getting a pop-up Command Prompt by running this code:

Set ObjWshShell = WScript.CreateObject("WScript.Shell")
ObjWshShell.Run "taskkill.exe /f /im MqrServerMon.exe", 0, False

"Installer" wrote:

Your WMI code should work providing that you use the right privileges:


strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate, " _
& "(Debug)}!\\" _
& strComputer & "\root\cimv2")

Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process " _
& "Where Name = 'someprocess.exe'")

For Each objProcess in colProcessList
intRetVal = objProcess.Terminate()
Next
WSCript.Echo "Just killed process " _
& " on " & strComputer


--
urkec

"urkec" <urkec@xxxxxx> wrote in message
news:6FC247B8-94DB-4E9B-A746-0DDF9031E5F6@xxxxxxAFAICS, the only difference between the OP's code and yours is the (Debug)
qualifier, yet your version works. What exactly does (Debug) do?

"Pegasus (MVP)" wrote:
Hello,

This privilege (SE_DEBUG_PRIVILEGE) is required to kill other users's
processes. You need to be an admin to be able to activate this privilege or
this one have to be manually granted to a user with the security policy
editor. The link below is very interesting (Specifically Table 6.8 :
Privileges and descriptions).

Hope this helps.

--
Gilles LAURENT
MVP Windows Server - Admin Frameworks
http://glsft.free.fr

"Pegasus (MVP)" wrote:

It is the short form (that you can use in the winmgmts: moniker) of
SeDebugPrivilege. You can also enable it with

objWMIService.Security_.Privileges.AddAsString("SeDebugPrivilege")

or

Const wbemPrivilegeDebug = 19
objWMIService.Security_.Privileges.Add(wbemPrivilegeDebug)

See here for the complete list of privileges:

http://msdn.microsoft.com/en-us/libr...58(VS.85).aspx
--
urkec

"Pegasus (MVP)" <I.can@xxxxxx> wrote in message
news:%23Iq4oitTJHA.5860@xxxxxxThanks to both Gilles and urkec for the clarification. Fascinating stuff!