COMMAND
taskkillStop a process or process tree
taskkill stops a running process by its PID (/PID) or image name (/IM). Add /F to force termination and /T to also kill child processes. Use it to close a hung application or free a port held by a stale process; avoid forcing critical Windows processes, which can crash the system.
Purpose
taskkill terminates processes from the command line. Its everyday uses are closing an application that Task Manager cannot, and freeing a network port held by a leftover process, for example a development server on port 3000 or 8080 reporting "address already in use".
Kill by PID
taskkill /PID 8210 /FFind the PID first with tasklist or netstat:
netstat -ano | findstr :3000
taskkill /PID 8210 /FKill by image name
taskkill /IM notepad.exe /FThis ends every process with that name; use a PID to target one instance.
Kill a process tree
taskkill /PID 8210 /T /F/T also terminates child processes, useful for a parent that spawned workers (a build tool, a browser).
Options
| Option | Effect |
|---|---|
/PID | Target by process ID |
/IM | Target by image name (wildcards allowed) |
/F | Force termination |
/T | Include child processes |
/FI | Filter (same syntax as tasklist) |
/S /U /P | Remote machine and credentials |
Example with a filter:
taskkill /FI "IMAGENAME eq chrome.exe" /FCautions
- Do not force critical processes. Killing lsass.exe, csrss.exe, wininit.exe or winlogon.exe crashes Windows or forces a restart. taskkill blocks some of these; others it will attempt.
- Prefer a graceful close without
/Ffirst, so the application can save state and clean up; force only if it will not respond. - Killing a service's process is not the right way to stop a service; use sc stop or
net stopso the Service Control Manager handles it.
PowerShell equivalent
Stop-Process -Id 8210 -Force or Stop-Process -Name notepad -Force. Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process -Force frees a port in one line; see Get-NetTCPConnection.
Frequently asked questions
How do I kill the process using a port?
Find the PID with netstat -ano | findstr :PORT, then taskkill /PID <pid> /F. This is the usual fix for "address already in use" on development ports like 3000 or 8080.
What is the difference between /F and /T?
/F forces termination without letting the process clean up (like End Task). /T kills the process and all its children. They combine: taskkill /PID 1234 /T /F.
Why does taskkill say "Access is denied"?
The process belongs to another user or to the system, or it is a protected process. Run from an elevated prompt; some protected processes (anti-malware, lsass) cannot be killed at all, by design.