如何使用VBScript终止进程

Question

我有此VBScript代码来终止一个进程

  Const strComputer = "." 
  Dim objWMIService, colProcessList
  Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
  For Each objProcess in colProcessList 
    objProcess.Terminate() 
  Next  

它在某些进程中可以正常工作，但是任何在SYSTEM下运行的进程都无法停止它。

我需要添加任何内容以终止SYSTEM下的进程吗？

Answer 1

过去我已经做到这一点的方法是使用Microsoft SysInternals的PsKill。 PsKill可以终止系统进程和任何锁定的进程。

您需要下载可执行文件并将其与脚本放置在同一目录中，或将其路径添加到WshShell.Exec调用中。这是您的示例代码已更改为使用PsKill。

Const strComputer = "." 
Set WshShell = CreateObject("WScript.Shell")
Dim objWMIService, colProcessList
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'Process.exe'")
For Each objProcess in colProcessList 
  WshShell.Exec "PSKill " & objProcess.ProcessId 
Next

Answer 2

尝试显式声明断言调试特权{impersonationLevel=impersonate,(debug)}：

Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate,(debug)}!\\.\root\CIMV2")
Set procs = wmi.ExecQuery("SELECT * FROM Win32_Process WHERE Name='SearchIndexer.exe'", , 48)
For Each proc In procs
    proc.Terminate
Next