Before terminating a service using Kill.exe, check Performance Monitor and the Event Viewer for additional information. If the service shows some activity for the service being stopped, it may just be a matter of time before the service stops. If Performance Monitor shows zero activity for a period of time (for example, 10 minutes), the service is most likely uncontrollable.
By having the uncontrollable process stopped, it may be possible to cleanly stop the other services.
If the KILL utility is used against the information store or directory, database recovery will occur when the service is started. Monitor the Event Viewer and Performance Monitor when such a situation occurs.
Terminating the MTA will force the service to run a MTACheck at the next service start.
When using the KILL utility, it's easiest to specify the service by using its executable file name. It is also possible to terminate the process using Kill.exe based on the process ID. The process ID is assigned by Windows NT Server and is not a fixed identifier. Tlist.exe shows each process and its process ID. The following tables shows services and their process names.
| Service Name | Process Name |
| System attendant | MAD.EXE |
| Directory | DSAMAIN.EXE |
| Information store | STORE.EXE |
| MTA | EMSMTA.EXE |
| Internet Mail Service | MSEXCIMC.EXE |
| Key Manager | KMSERVER.EXE |