Thanks for the cool tip Roy. Could not have come at a better time. I have been having trouble trying to load a large playlist in WinAmp. It kept hanging and I was having a heck of a time trying to kill the process! Not anymore.
BTW Family/Personal Health before Professional Health. Nice to see someone with their priorities straight.
This was a good way to kill processes on Win2K, which doesn't come with a command line tool like kill.exe. The reason it works in some cases when task manager doesn't is because ntsd enables SeDebugPrivilege, allowing you to open processes that you otherwise wouldn't have access to.
On XP and Win2003 however you should just use taskkill.exe. It's more reliable and should even work in some cases when ntsd wouldn't - for example, if the process is deadlocked on the loader lock. Ntsd will not be able to attach to such process (it will eventually time out and suspend it, but when you type 'q' it will simply quit and resume the process (unless you do .kill first)).
Wow Pavel. Thanks for the great advice! I didn't even know TaskKill existed up until now. Perhaps you have some more cool low level debugging and process manipulation stuff you'd like to share? actually, why don't you have a weblog?
:)
OK, here's another tip :)
One situation where ntsd does come in handy even on XP+ is when you want to change priority of a system process.
Let's say a service (for example, msdtc) is taking up 100% CPU. You want to let it finish whatever it's doing but you don't want it to slow down your interactive processes.
So you open up task manager, right-click on the msdtc process and try to change its priority. This fails with access denied because msdtc runs as NETWORK SERVICE and its security descriptor doesn't give you any access.
Pavel: Very nice! So theoretically I could create a batch file to run at startup that launches the Task list with elevated seDebug privilages using ntsd.. right?
the only question now is how to you send a "qd" to ntsd from a batch file once ntsd is already running on the shell.
hmmm.... any idea?
Awsome! What exactly do you do to have such in depth knowledge in this area?
If I start TaskMgr with the elevated priviliges I'm guessing it will also have the power to kill those processes that wouldn't die earlier. am I right?
Also - is there a way to mimic such a process that wouldn't die any other way just so I can test it out?
Obviously you start the whole sequence by using the kill-p1.bat !!!