neděle 15. prosince 2019

How to kill processes without the necessary privileges

Windows have one strange property: the shutdown is not an atomic operation. Hence, if you do not have the privilege to terminate programs (like an antivirus on a corporate machine) but still have a privilege to perform shutdown (quite common on laptops), you may still succeed in killing the unwanted processes.

The procedure:
  1. Open Excel.
  2. Invoke Windows shutdown.
  3. Windows will tell you that Excel has unsaved documents. Do nothing. Just wait until all unwanted processes are killed. 
  4. Cancel the shutdown.
How to mitigate this security weakness:
  1. Run regedit
  2. Go to HKEY_CURRENT_USER\Control Panel\Desktop
  3. Set AutoEndTasks to 1