Parent Process ID

[David]

I am attempting to determine if a process running locally is orphaned? It
looks like I need to access the th32ParentProcessID member of the
PROCESSENTRY32 structure. Is there a way to read the PROCESSENTRY32 structure
with PowerShell or another method to determine the process parent id?

[Kiron]

Through WMI's Win32_Process' ParentProcessID property:

gwmi win32_process |ft Name, ProcessID, ParentProcessID -a
gwmi win32_process |? {$_.ParentProcessID} |ft Name,ParentProcessID -a
gwmi win32_process |? {!$_.ParentProcessID} |ft Name,ParentProcessID -a

# aliases used:
# gwmi = Get-WmiObject
# ? = Where-Object
# ! = -not (operator)
# ft = Format-Table
--
Kiron

[Kiron]

Ignore my previous post, I misunderstood your question and thought you just wanted to retrieve the ParentProcessID.
This will filter each process whose parent process is terminated or if its ParentProcessID inaccurately points to a 'parent' process created after it.

$wmi = [wmi]''
$col = gwmi win32_process | ? {
$parent = gwmi win32_process -f "ProcessID='$($_.parentProcessID)'"
$parentCreationDate, $creationDate = $(
if ($parent -and $_.parentProcessID) {
$wmi.ConvertToDateTime($parent.CreationDate),
$wmi.ConvertToDateTime($_.CreationDate)
} else {$null,$null})
!$parent -or $parentCreationDate -gt $creationDate
}
Remove-Variable wmi
$col | ps -ID {$_.processID}

--
Kiron

[David]

Thank you Kiron! Checking the creation dates was an added feature I had not
thought of. I seem to alway overlook wmi when attempting to solve these types
of problems.

[forgiv...@gmail.com]

OP's question is over but this is for future reference. This is "another method to determine the process parent id":


(gwmi win32_process -filter "ProcessID=$pid").ParentProcessID