Kill that errant xp_cmdshell initiated process

Sometimes you end up with a Windows process that really should be terminated but you don't have power to terminate it, even as the administrator on the machine.

This can cause major problems if a curious individual decides to try out something that you mention that should be avoided.

Today I had one of the instructors from another technical area in the class. When I mentioned the xp_cmdshell command and how it can be really troublesome if someone leaves a client application on the server and it is inadvertently activated, he went ahead and tried it.

Now running Notepad.exe via xp_cmdshell is not a good idea. However, I am glad he did it because I learnt something new.

If this happens again I will know that you can use the AT command as follows:-

AT time /INTERACTIVE cmd

time is replaced by the time that you wish to run the command

/INTERACTIVE means that you want to use the outcome of the command and then terminate it yourself

cmd is the command you want to activate.

Set the time to a couple of minutes into the future and submit the line at the command prompt. In a couple of minutes a new window will open up and you can run taskmgr.exe which will bring up the taskpad. Now you can delete the errant notepad process without complaint from the system. However, be careful not to delete anything else and close down the command window straight away.

The good thing about teaching is that you learn something new each time you run a course, it may appear to be peripheral information, but it usually isn't.

Thanks Brian for your contribution to this knowledge byte ;-)