Working theory:

All methods which normally would gracefully close IISExpress.exe all depend upon there being an interactible window process that WM_CLOSE can be sent to.

Even though it's a console application, it can still receive a WM_CLOSE message as long as it was launched under circumstances which WM_CLOSE would work under, ie, an interactive desktop.

My theory is that the Team City Agents, when running their build steps, do not launch those steps under interactive desktops, so there is no window handle, and there is no way for it to process WM_CLOSE, so that's why TaskKill /IM does not work without the /F parameter.

Now, to figure out how to make it so that it *can* work. How to force an interactive desktop session.