You're staring at a Windows Server 2008 R2 machine where NSClient++ has stopped responding to Nagios checks. The service appears frozen, and all standard termination methods fail. Here's what we're dealing with:

• Service Manager reports "service took too long to respond"
• Multiple instances of nsclient++.exe persist after kill attempts
• Standard tools (taskkill, pskill) report success but processes remain
• Process Explorer shows threads stuck in unloading state

When conventional methods fail, we need to escalate our approach:

1. Using SC to Force Service Removal

sc queryex nsclient++
sc stop [SERVICE_NAME]
sc delete [SERVICE_NAME]

This removes the service registration completely before dealing with the process.

2. NTSD Debugger Method

Attach the Windows debugger to forcefully terminate:

ntsd -pn nsclient++.exe
~*k
q

3. PowerShell Termination Chain

A more comprehensive PowerShell approach:

$process = Get-WmiObject Win32_Process -Filter "name='nsclient++.exe'"
$process.Terminate()
if ($process) {
    Stop-Process -Id $process.ProcessId -Force -ErrorAction SilentlyContinue
    [System.Diagnostics.Process]::GetProcessById($process.ProcessId).Kill()
}

For processes stuck in unloading state, we need thread-level intervention:

handle.exe -p [PID] -a

After identifying stuck threads:

kill -f [THREAD_ID]

For production environments, consider these preventive measures:

# Create a scheduled task as fallback
schtasks /create /tn "NSClient++ Watchdog" /tr "powershell -command \"if (!(Get-Service nsclient++)) { Start-Service nsclient++ }\"" /sc minute /mo 5

If all else fails but you can't afford a full reboot:

shutdown /r /t 60 /c "NSClient++ recovery" /f

This gives you a minute to abort if the service recovers, while forcing stuck processes to terminate during shutdown.

---

Dealing with hung services on Windows Server 2008 R2 can be particularly challenging when standard methods like Task Manager or taskkill fail to work. In this case with NSClient++, we're seeing processes that refuse to die despite multiple termination attempts, even with elevated privileges.

From the Process Explorer screenshot, we can see the NSClient++ processes are stuck in an unloading state. This typically indicates:

• Threads waiting on synchronization objects that will never be signaled
• Deadlocked cleanup routines
• Pending I/O operations that can't complete

When traditional methods fail, try these approaches in sequence:

1. Using Windows Resource Kit's kill.exe

This utility often succeeds where others fail:

kill -f nsclient++.exe

2. NTSD Debugger Method

The Windows Debugger can forcefully detach and kill processes:

ntsd -pn nsclient++.exe
.symfix
.reload
q

3. PowerShell Termination

PowerShell offers several ways to terminate stubborn processes:

# Method 1
Stop-Process -Name "nsclient++" -Force

# Method 2 (more aggressive)
Get-WmiObject Win32_Process -Filter "name='nsclient++.exe'" | ForEach-Object { $_.Terminate() }

4. Service Control Deep Dive

When the service control manager can't stop the service:

sc queryex nsclient++
sc stop nsclient++ /force
sc delete nsclient++

To free up the TCP port while you work on terminating the process:

netstat -ano | findstr 5666
FOR /F "tokens=5" %P IN ('netstat -aon ^| findstr 5666') DO taskkill /F /PID %P

After successful termination:

1. Delete any temporary files in %TEMP% related to NSClient++
2. Check Event Viewer for related errors
3. Verify registry entries at HKLM\SYSTEM\CurrentControlSet\Services\NSClient++

To avoid recurrence:

• Schedule regular service restarts during maintenance windows
• Implement proper service dependency timeouts
• Consider running NSClient++ in test mode with logging enabled