How to Find and Kill a Stuck xp_cmdshell Process in SQL Server

Image Description

August 09, 2025

Find & Terminate a Stuck xp_cmdshell Process in SQL Server

While our website focuses on healthcare EDI topics, sometimes we share technical tips that can help you in other areas of your work. Today, we’re stepping outside the EDI world to show you how to locate and terminate a stuck xp_cmdshell process in Microsoft SQL Server — a skill you might find useful when troubleshooting stubborn database or automation issues.

Often, simply killing the SQL session running xp_cmdshell will not stop the underlying Windows process. In these cases, SQL Server will attempt to roll back the session, but the rollback can hang indefinitely if the external process does not exit on its own. That’s why it’s important to locate and terminate the actual xp_cmdshell process itself — ensuring that both the SQL session and the Windows process are stopped.

This happened to me while testing a process with xp_cmdshell directly from SQL Server Management Studio. My SSMS instance locked up completely, forcing me to close it through Task Manager. Without realizing it, the xp_cmdshell process kept running in the background on the SQL Server. Killing the session ID from SQL had no effect — the process continued running until I found its Process ID (PID) and terminated it directly from the operating system.

Prerequisites

  • xp_cmdshell is enabled (requires sysadmin or appropriate proxy/credential).
  • The SQL Server service account has permission to query processes and to terminate them.
Step 1 — List cmd.exe processes with PID and command line

Run this to list all cmd.exe processes with their full command lines and PIDs. This helps identify which one was spawned by your xp_cmdshell call (look at the CommandLine text). 

EXEC xp_cmdshell 'wmic process where "name=''cmd.exe''" get ProcessId,CommandLine /format:list';

What it does:

  • wmic process where "name='cmd.exe'" filters to Windows command shell processes.
  • get ProcessId,CommandLine returns the PID and the exact command that launched the process.
  • /format:list prints each field on its own line for easy reading in SSMS results.

Tip: If you know part of the command (e.g., it called PowerShell or a specific script), search the results for that text to pinpoint the stuck process.

Step 2 — Terminate the specific PID

Replace <pid_number> with the PID you identified in Step 1 to kill that single process: 

EXEC xp_cmdshell 'taskkill /F /PID <pid_number>';

What it does:

  • taskkill is the Windows command to end processes.
  • /F forces termination (no graceful shutdown).
  • /PID <pid> targets the exact process ID you want to end.

Optional: Stop the SQL session

  • If the SQL session running xp_cmdshell is still active, kill it: 
    KILL <session_id>;

Note: Different Window Versions

  • On newer Windows builds, wmic is deprecated. You can use PowerShell’s Get-Process command for similar results: 
    EXEC xp_cmdshell 'powershell -Command "Get-Process cmd | Select-Object Id,Path"';

We hope you found this article helpful! Please reach out to us with questions/feedback.

See more articles