How to stop “NOT_STOPPABLE” windows services via command line

In previous post, I’ve shared how to stop “STOPPABLE” windows service via command line.

An example of STOPPABLE” windows service is “themes”

C:\>sc query themes

SERVICE_NAME: themes

TYPE               : 20  WIN32_SHARE_PROCESS

STATE              : 4  RUNNING

(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

C:\>

What if the service is “NOT_STOPPABLE”?

An example of STOPPABLE” windows service is “TermService” (Terminal Services)

C:\>sc query termservice

SERVICE_NAME: termservice

TYPE               : 20  WIN32_SHARE_PROCESS

STATE              : 4  RUNNING

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

C:\>

C:\>sc stop TermService
[SC] ControlService FAILED 1052:

The requested control is not valid for this service.
C:\>

C:\>net stop TermService
The requested pause or stop is not valid for this service.

More help is available by typing NET HELPMSG 2191.
C:\>

I’ve found a very good blog here and leave a comment there.

https://www.netspi.com/blog/entryid/116/penetration-testing-stopping-an-unstoppable-windows-service

Hopefully, someone will assist me on this issue.

FirewallEngineer said on 11/22/2013:

Hi, I would appreciate if you could share how to stop the TermService via command line.

C:\>sc query | findstr -i term
SERVICE_NAME: TermService
DISPLAY_NAME: Terminal Services

C:\>
C:\>sc qc TermService
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: TermService
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WINDOWS\System32\svchost -k DComLaunch
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Terminal Services
DEPENDENCIES : RPCSS
SERVICE_START_NAME : LocalSystem

C:\>
C:\>tasklist | find /i “svchost”
svchost.exe 880 Console 0 4,564 K
svchost.exe 968 Console 0 3,976 K
svchost.exe 1060 Console 0 20,716 K
svchost.exe 1116 Console 0 2,760 K
svchost.exe 1184 Console 0 4,192 K

C:\>

This comment will not appear until it is approved.

REFERENCE:

http://bartdesmet.net/blogs/bart/archive/2004/10/16/438.aspx

https://www.netspi.com/blog/entryid/116/penetration-testing-stopping-an-unstoppable-windows-service