Is there a way to find out which process started a other process even after the parent process is terminated?
I tried to find something in the Win32_Process class
via PowerShell but I did not find anything relevant.
processwindowswindows-server-2008-r2
Is there a way to find out which process started a other process even after the parent process is terminated?
I tried to find something in the Win32_Process class
via PowerShell but I did not find anything relevant.
Best Answer
The
Win32_Process
WMI class does tell you the ID of the process that spawned the child process. However, the ParentProcessID is not part of the default property set; you have to specifically ask for it.It's worth noting however that grandparent process IDs are not tracked.