VMware ESXi and vSphere Cluster Management

Kill a Process Tree with Process Explorer

Learn how to use Process Explorer to terminate a parent process and all of its child and descendant processes safely.

Process Explorer can terminate one process or an entire process hierarchy. The Kill Process Tree command is useful when an application has spawned helpers, workers, renderers, or other child processes that remain after the main window closes.

What is a process tree?

A process is a running instance of an application, service, or Windows system component. Each running process has a numeric PID, or process identifier, that distinguishes it from other instances.

A parent process is the process that starts another process. The process it starts is a child process. A descendant process is any process below a selected process in the hierarchy, including children, grandchildren, and later generations.

A process tree represents processes launched directly or indirectly by another process. For example, a development tool might start a compiler, which starts a linker. The development tool is the parent of the compiler, while both the compiler and linker are descendants of the development tool.

One application can appear as several separate processes because modern software divides work among independent components. A web browser, for example, may use separate processes for the main interface, tabs or renderers, extensions, graphics, networking, and background tasks. These processes can improve stability and security, but they also mean that closing or terminating one process may not stop the whole application.

What Kill Process Tree does

Kill Process Tree forcibly ends the selected process and all of its descendants. The affected processes stop immediately rather than receiving the application's normal shutdown request.

This differs from Kill Process, which forcibly ends only the selected process. If you select a child process, Kill Process Tree affects that child and anything below it, not its parent or the parent's other children.

For example, selecting a browser's main process and using Kill Process Tree can close the browser's entire process group. Selecting one renderer process instead affects that renderer and its own descendants only.

When to use Kill Process Tree

Use it when an application has spawned multiple processes and closing or killing one process does not fully stop the application.
Use it for a hung application whose interface no longer responds.
Use it when a failed launcher leaves orphaned child processes running.
Use it for cleanup during development or automated testing when a test tool leaves workers, terminals, or helper programs behind.
Use it for applications with helper, renderer, worker, GPU, network, or background processes when the entire application must be reset.

Examples

Multi-process browser: Select the browser's top-level process to close the complete browser group. Selecting one renderer affects only that renderer rather than every browser process.

Hung development tool: An IDE or build tool may leave compiler, language-server, terminal, or worker processes running after its main interface stops responding. Killing the top-level tree removes those descendants in one operation.

Stuck installer or updater: An installer may launch helper executables and remain blocked. Inspect the hierarchy to identify the installer parent and its helpers before terminating the group.

Display processes as a tree in Process Explorer

Process Explorer must display processes in hierarchical process-tree order before the tree command is available or useful. In the tree view, child processes appear indented beneath their parent, and process groups can usually be expanded or collapsed.

Open Process Explorer.
If the target may belong to another user or requires extra permissions, run Process Explorer with elevation. Use the available administrator or elevation action and approve User Account Control when prompted.
Verify that the process list is using its hierarchical process-tree display or tree sorting option. Process Explorer versions can present this setting differently, so use the view or sorting controls that show parent-child relationships.
Expand the suspected application's group if its children are hidden.
Locate the top-level parent process for the application. Do not select only a visible child when your goal is to stop the complete application group.

Look for indentation and expandable process groups. Also compare the process name, executable path, command line, user, and PID. These details help distinguish multiple instances with similar names.

Steps to kill a process tree

Save work and close the application normally if it still responds.
Open Process Explorer with sufficient privileges.
Switch to or verify the hierarchical process-tree display.
Find the target application's process group and expand it if necessary.
Select the intended parent or root process.
Right-click that process.
Choose Kill Process Tree.
Read the warning prompt. Confirm only if you understand that the selected process and its descendants will be forcibly terminated.
Verify that the parent and descendants disappear from the process list. Refresh the view or wait briefly if necessary.

If the application starts again immediately, termination succeeded but another service, scheduled task, watchdog, startup entry, or launcher may have restarted it.

Select the correct process

Selecting the correct root matters. A child process may have a familiar name, but selecting it does not necessarily stop the parent application or its sibling processes.

Target selected — What is terminated — When to choose it

Parent or root process — The selected parent and all descendants — Choose this when the entire application group must stop.

Child process — The selected child and its own descendants — Choose this when one malfunctioning helper, renderer, or worker should stop while the parent and other children remain active.

Unrelated process with a similar name — That separate process and, with the tree command, its descendants — Do not choose it based on name alone; confirm its path, command line, user, parent relationship, and PID.

A shared or system-related parent may have unrelated work beneath it. Terminating that parent tree can stop services or applications that you did not intend to affect. When several instances exist, record the PID and inspect the executable path and command line before acting.

Termination actions compared

Action — Processes affected — Typical use case — Primary risk

Kill Process — One selected process — Stop one misbehaving child or individual application instance — The process loses unsaved state, while related processes may continue running.

Kill Process Tree — The selected process and all descendants — Stop a complete multi-process application or clean up orphaned workers — All affected processes stop immediately and may lose data or interrupt operations.

Suspend Process — Temporarily pauses the selected process rather than terminating it — Freeze a process briefly for investigation or testing — The application may appear hung, hold resources, or leave dependent processes waiting.

Use an individual process action when only one child is defective and the rest of the application should continue. Use Kill Process Tree when the complete hierarchy must be stopped. Suspension is not termination: a suspended process can usually be resumed, but it continues to exist and retain resources.

Safety and permissions

Forced termination can discard unsaved documents, interrupt file copies, leave temporary files, and produce incomplete transactions.
Applications may need repair or a restart after being terminated during an update, database operation, or configuration change.
Protected processes, elevated processes, and critical system processes may not be terminable by the current user.
Run Process Explorer elevated only when appropriate and when you understand the target. Elevation provides administrative permissions; it does not make terminating a critical process safe.
Avoid terminating critical Windows processes unless you have confirmed their role and understand the possible effect, such as service disruption, sign-out, instability, or system shutdown.

Troubleshooting

Kill Process Tree is unavailable or disabled

The process list may not be in process-tree sorting or hierarchical display mode. Enable the applicable tree view or sorting option.
The selected item may not be displayed in a hierarchical process context. Select the intended parent in the tree.
Process Explorer may lack the privileges required for the target. Restart or elevate it when appropriate.

Some related processes remain

The remaining process may not be a descendant of the selected parent. Inspect its parent relationship, path, command line, and PID.
A service, scheduled task, watchdog, or separate launcher may have restarted it.
You may have selected the wrong instance of the parent. Compare identifiers and executable details, then select the actual root of the application group.

Access is denied

The process may belong to another user, require administrative rights, be protected, or be a critical system component. Elevate Process Explorer when appropriate. Do not force termination of protected or critical processes without confirming the consequences.

The application immediately starts again

Trace the new process's parent, executable path, command line, and PID. Identify whether a background service, startup entry, Task Scheduler job, watchdog, or launcher is responsible. Stop or reconfigure that mechanism only if doing so is intentional and safe.

Exam-relevant notes

A parent process starts a child process; a descendant includes children at every level below a selected process.
Kill Process affects one selected process. Kill Process Tree affects the selected process and all descendants.
Selecting a child does not terminate its parent or siblings.
Process-tree indentation helps identify the correct root process.
Forced termination can cause data loss and interrupted operations.
Elevation may be required, but protected and critical processes may still resist termination.