How do I kill a stalled backup process?

A. If you use the AT command (i.e., the schedule command) to start a backup and NT Backup has a problem, when you try to run Task Manager to kill the process you’ll receive an error message saying you don't have the proper authority. The only solution is to reboot the server.

If you use the /interactive switch with the ntbackup command, you can create a special version of Task Manager to kill the rogue NT Backup process, rather than rebooting the server. Simply use the AT command to start Task Manager 1 minute in the future.

at [\]  /interactive taskmgr

The computer name field is optional and starts Task Manager on another machine.

Alternatively, use the Microsoft Windows NT Resource Kit’s Soon utility.

soon 30 /interactive taskmgr

Task Manager will display in 30 seconds, and you can kill the NT Backup process.

Yet another method is to use the resource kit’s Tlist and Kill commands. Although you need administrative privileges to run the Kill program, you might find this method preferable to fumbling with the AT command and waiting for the command to start Task Manager as a system account. First, use Tlist to see the active tasks and their process identifiers (PIDs).

tlist -t | more

You’ll see the following output.

ATSVC.EXE (315)
CMD.EXE (345)
NTVDM.EXE (348)
NTBACKUP.EXE (314)

The PID will vary depending on the system. The -t option is important and provides a treelike output to show which process is the parent or child.

Use Kill to end the parent process (i.e., cmd.exe) and the NT Backup command.

kill -f 345

Killing the parent process doesn’t kill the child processes the parent created. After you kill cmd.exe, you need to kill the child processes that cmd.exe called.

Be sure not to kill the atsvc.exe process, or you’ll kill the Schedule Service. Then, you’ll need to restart the service.

If you need to kill a backup process on a remote server and can't get to the console, load the resource kit’s Rkillsrv utility as a service on the remote machine. Then, use the resource kit’s Rkill utility on your local machine. You need administrative privileges on the target system to kill the stalled process.

To obtain the process list on the server, enter

rkill /view \

To kill the PID process on the server, enter

rkill /kill \ pid

To put your remote security token on the server, enter

rkill /token \

A final hint is to always run the command

kill.exe -f ntbackup.exe

at the beginning of a scheduled NT Backup job. This command will kill any old backup jobs that are running.