Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to figure out a way through the Windows command line to determine if a process has no parent. I know all processes technically have a parent that is controlled by the OS or whatever, but for the sake of simplicity it "has no parent". For instance, if you open an explorer window, it will show up in Process Explorer at the top of its process tree. When I do a wmic query on the process, however, I get a PID for 'parentProcessPID'. When I try and look up that PID using tasklist, it says that PID is not recognized. I have looked at a couple of processes like this and they seem to have different parent processes that are all inaccessible through tasklist. If a process has a parent process that is inaccessible through tasklist, does that mean it is at the "top" of its process tree?

The reason why I am asking is that I am trying to differentiate between a program running by itself and the same program running as a child process of another program.

For example:

Lets say I go into the Windows start menu and open up an explorer window. Then, I open up a cmd window and type: explorer.exe. I now have two explorer.exe processes. One is a child process of cmd.exe and one is a stand alone process. I want to be able, through a wmic or tasklist query, to single out all explorer.exe processes that are a stand alone process. So, the process I started through the Windows start menu should be returned and not the process started by cmd.exe.

The issue I am running into is every process has a parent process ID and I do not know how to differentiate between a parent process coming from a program or the parent process coming from a process related to the OS. If I can do the following, that would be great:

pseudocode:

wmic process where name=explorer.exe get parentProcessID,processID
tasklist /fi "PID eq <parentProcessID>" 2>&1> log.txt
if(log.txt contains "INFO: No tasks are running which match the specified criteria."){
    //parent PID is not recognized by tasklist
    //do something
}

but I am unsure if my logic is correct.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Not sure how to do it from command line, but I wrote this to do some filtering of OS related processes from Powershell. Maybe it will give you an idea. It skips items owned by service, system and null.

gwmi win32_process |select ProcessID,ParentProcessID,Name, @{l="Username";e={$_.getowner().user}}|where {$_.Username -ne "SYSTEM"} | where {$_.Username -ne "LOCAL SERVICE"} | where {$_.Username -ne "NETWORK SERVICE"} | where {$_.Username -ne $null} |Sort-Object ProcessID | ft -AutoSize
#

Output

    ProcessID ParentProcessID Name                    Username
--------- --------------- ----                    --------
     2136            3460 notepad.exe             KNUCKLE-DRAGGER
     2504            3460 firefox.exe             KNUCKLE-DRAGGER
     2792             700 dllhost.exe             KNUCKLE-DRAGGER
     2816            4232 conhost.exe             KNUCKLE-DRAGGER
     2916            3460 powershell.exe          KNUCKLE-DRAGGER
     3128            3460 notepad.exe             KNUCKLE-DRAGGER
     3180             576 taskhost.exe            KNUCKLE-DRAGGER
     3196            4308 vmware-tray.exe         KNUCKLE-DRAGGER
     3460            4392 explorer.exe            KNUCKLE-DRAGGER
     3644            4636 vmware-vmx.exe          KNUCKLE-DRAGGER
     3696            3460 mplayerc.exe            KNUCKLE-DRAGGER
     4636            3196 vmware.exe              KNUCKLE-DRAGGER
     4828            3460 notepad.exe             KNUCKLE-DRAGGER
share|improve this answer
    
and you can see most items in the list are owned by 3460 which is my explorer.exe –  Knuckle-Dragger Dec 16 '13 at 17:41
    
I guess in my example, all processes would not be owned by system, local service, or network service. But, all processes I am trying to look at have actually been created by a Windows service running under the LOCAL SYSTEM user. So the differentiation have to work for both types of processes started in session 0 under the local system user. –  user972276 Dec 16 '13 at 17:51
    
You need to look at which processes have a parent process ID that doesn't exist. I.e., if explorer.exe's parent process is listed as PPID 5072, but there is no process with a PID of 5072 running on the system, then you have an unparented process. –  Darth Android Dec 16 '13 at 18:38
    
so create one GWMI of parent id's filtering just the processes you want to check, then run a second GWMI of all pids and foreach on the list of parent id's from the first query. The ones that don't have match are $profit. –  Knuckle-Dragger Dec 17 '13 at 6:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.