What's the difference between Closing and Killing a program?

When you close a program - through any of a number of standard ways - what you're actually doing is asking the program to close itself.

When a program shuts down or "closes", it has the opportunity to finish writing to any files it might have open, save your settings, save your documents, delete any temporary files, and otherwise perform an orderly exit.

It's like asking a guest to leave, and as they take their time on the way out they make sure to finish their drink and take their coat.

"Killing" a program - which typically takes a special utility like Task Manager or Process Explorer - doesn't ask the program anything. The operating system is instructed to stop running the program immediately. The program has no say in the matter. It doesn't get a chance to clean up on the way out, and thus documents may not be saved, temporary files may not be deleted, and so on.

If you physically kick your guest out, their drink might be left half-empty, and they might well leave their coat behind. But one way or another, the guest is gone.

Now, things can get a tad confusing because some programs don't really exit when you ask them to close. Continuing the metaphor, after asking them to go it's as if your guest ducked into the closet instead of leaving. They're still around, you just can't see them.

I see this in Microsoft Outlook from time to time - you type ALT+F4 to exit, and by all appearances it has. But if you fire up process explorer you'll see that OUTLOOK.EXE might still be running. You can then use Task Manager to kill it, if you like.

Programs do this for various reasons - the most common being that when you then ask them to start again they appear more quickly. (No, I'm not going to extend my metaphor any further, even though it's tempting to have something about your guest suddenly jumping out of hiding when you call and ask him to return. )

Other programs may have other reasons for hanging around; perhaps they actually appear to exit very quickly, but the actual process of closing and cleaning up might take some time.

As you can imagine, actually killing a program shouldn't be done lightly. In fact, it should never really be necessary, but reality is that sometimes you have to kick out your misbehaving guest. The risk is that you might lose whatever data that program was operating on, and might leave orphaned temporary files that otherwise would have been automatically cleaned up.

In addition, it can be risky to kill system processes like svchost, lsass and others. If they can be killed (some cannot), it's possible to crash your system on the spot.