How to terminate process using VBScript - windows

I have this VBScript code to terminate one process
Const strComputer = "."
Dim objWMIService, colProcessList
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
For Each objProcess in colProcessList
objProcess.Terminate()
Next
It works fine with some processes, but when it comes to any process runs under SYSTEM, it can't stop it.
Is there is anything I need to add to kill the process under SYSTEM?

The way I have gotten this to work in the past is by using PsKill from Microsoft's SysInternals. PsKill can terminate system processes and any processes that are locked.
You need to download the executable and place it in the same directory as the script or add it's path in the WshShell.Exec call. Here's your sample code changed to use PsKill.
Const strComputer = "."
Set WshShell = CreateObject("WScript.Shell")
Dim objWMIService, colProcessList
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
For Each objProcess in colProcessList
WshShell.Exec "PSKill " & objProcess.ProcessId
Next

Try explicit assert debug privilege {impersonationLevel=impersonate,(debug)}:
Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate,(debug)}!\\.\root\CIMV2")
Set procs = wmi.ExecQuery("SELECT * FROM Win32_Process WHERE Name='SearchIndexer.exe'", , 48)
For Each proc In procs
proc.Terminate
Next

Related

WScript.Shell not opening command window

I have an executable EMC_WS.EXE and I want to run this using the command
WshShell.Run "EMC_WS.EXE", 1, False
The executable runs correctly, but the command window is not appearing. I have used mingwstudio to generate EMC_WS.EXE.
Dim pathString, UserPath
Dim position
Dim WshShell, Shell
Set WshShell = WScript.CreateObject("WScript.Shell")
Set Shell = WshShell.Environment("User")
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'EMC_WS.EXE'")
For Each objProcess In colProcessList
objProcess.Terminate()
Next
WshShell.Run "EMC_WS.EXE", 1, False
Set WshShell = Nothing
WScript.Quit(0)

vbscript- explorer process restored automatically after kill

I've used the below script a couple of times to kill processes in a vbscript without any issues.
This time I'm trying to kill explorer.exe. Only issue is after I use the script to kill explorer.exe within 2 seconds explorer process restores.
I don't understand ? because if I manually kill explorer.exe with Task Manager, the process is killed until I start the process again. So whats the issue with the below script?
Option Explicit
Dim objWMIService, objProcess, colProcess
Dim strComputer, strProcessKill
strComputer = "."
strProcessKill = "'explorer.exe'"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = " & strProcessKill )
For Each objProcess in colProcess
objProcess.Terminate()
Next
WScript.Quit
A way :
Set oCMD = CreateObject("WScript.Shell")
oCMD.Run "taskkill /f /im explorer.exe",0,True
You can try like this :
Option Explicit
Dim objWMIService, objProcess, colProcess
Dim strComputer, strProcessKill
strComputer = "."
strProcessKill = "'explorer.exe'"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = " & strProcessKill )
For Each objProcess in colProcess
objProcess.Terminate(1)
Next
Or like this way :
Option Explicit
Dim Process
Process = "Explorer.exe"
Call Kill(Process)
'****************************************************
Sub Kill(Process)
Dim Ws,Command,Execution
Set Ws = CreateObject("Wscript.Shell")
Command = "cmd /c Taskkill /F /IM "& Process &""
Execution = Ws.Run(Command,0,True)
Set Ws = Nothing
End Sub
'****************************************************

VB script Kill process and delete folder

I am a noop when it comes to vbscript but I managed to make something. But now I am kinda stuck.
Let me try to explain what I am trying to do
I need to kill a process on a computer [That part I know and made] VBpart 1
When the process is killed I need to delete a folder with all it content [ That I managed also] VB part 2
VB part 1
Option Explicit
Dim objWMIService, objProcess, colProcess
Dim xComputer, xProcessKill
xComputer = "."
xProcessKill = "'diamant client.exe'"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& xComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = " & xProcessKill)
For Each objProcess in colProcess
objProcess.Terminate()
next
VB part 2
strFolder = "\\srvad01\DFS\Sandbox$\username\sandbox\DiaSoft Framework Diamant Client 1.0 NL"
set objFSO = createobject("Scripting.FileSystemObject")
objFSO.DeleteFolder strFolder
But somehow I can't merge these 2 in 1 file While they work separate fine
What am I doing wrong?
Kind regarts Arie

Check to see if the script has already run before on a particular machine?

So I have the following scipt that I run when a user logs off using the logoff script section in Group Policy (I would like to run a check to see if it has already run before on the particular computer. If it has run before I would like the script to exit. If it hasn't then I want it to run the script and mark itself as "already been run". How can I do that?):
strComputer = "." Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters = objWMIService.ExecQuery _
("Select * from Win32_Printer Where Network = TRUE")
For Each objPrinter in colInstalledPrinters
objPrinter.Delete_ Next
I figured it out. Here's the revised script:
Option Explicit
Dim oShell,strComputer,objWMIService,colInstalledPrinters,objPPrinter
Private Function KeyExists (keyName)
Dim bKey
On Error Resume Next
bKey = oShell.RegRead(keyName)
If TypeName (bKey) = "Empty" Then
KeyExists = False
Else
KeyExists = True
End If
End Function
Set oShell = CreateObject("Wscript.Shell")
If keyExists("HKEY_LOCAL_MACHINE\Software\CRusse\RemovePrinters") Then
wscript.quit
Else
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters = objWMIService.ExecQuery _
("Select * from Win32_Printer Where Network = TRUE")
For Each objPrinter in colInstalledPrinters
objPrinter.Delete_
Next
oshell.RegWrite "HKEY_LOCAL_MACHINE\Software\CRusse\RemovePrinters", 1, "REG_SZ"
End If
Set oShell = Nothing

Using VBScript how can I check if the Spooler service is started and if not start it?

I'd like to use VBScript to check if the Spooler service is started and if not start it, the code below checks the service status but I need some help modifying this so I can check if it is started.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colRunningServices = objWMIService.ExecQuery _
("Select * from Win32_Service")
For Each objService in colRunningServices
Wscript.Echo objService.DisplayName & VbTab & objService.State
Next
Many thanks
Steven
How about something like this. This command will start it if it isn't already running. No need to check in advance.
Dim shell
Set shell = CreateObject("WScript.Shell")
shell.Run "NET START spooler", 1, false
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colRunningServices = objWMIService.ExecQuery _
("select State from Win32_Service where Name = 'Spooler'")
For Each objService in colRunningServices
If objService.State <> "Running" Then
errReturn = objService.StartService()
End If
Next
Note you can also use objService.started to check if its started.
Just for the completeless, here's an alternative variant using the Shell.Application object:
Const strServiceName = "Spooler"
Set oShell = CreateObject("Shell.Application")
If Not oShell.IsServiceRunning(strServiceName) Then
oShell.ServiceStart strServiceName, False
End If
Or simply:
Set oShell = CreateObject("Shell.Application")
oShell.ServiceStart "Spooler", False ''# This returns False if the service is already running

Resources