{"id":1166,"date":"2012-06-03T11:36:01","date_gmt":"2012-06-03T06:06:01","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=1166"},"modified":"2019-05-12T02:56:42","modified_gmt":"2019-05-12T02:56:42","slug":"determine-parent-process-of-running-process","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/determine-parent-process-of-running-process\/","title":{"rendered":"How to Determine the Parent Process of a Running Process in Windows?"},"content":{"rendered":"

You may have come across situations where a continuous hard disk activity taking place although your system being in an idle state. If you open Task Manager out of curiosity, you may find several processes starting and exiting of their own without you doing anything. It could be a scheduled backup task, third-party system maintenance program or anything that could be churning your hard disk. It could be even a Malware. But which application or process launches them?<\/p>\n

You can find more information about a executable by searching on the internet. Knowing the parent process of a running process is important as well, and that can be accomplished in many ways. Here are some methods to know the parent process and process ID of a running process.<\/p>\n

Using Process Explorer<\/h2>\n

Process Explorer is a great program that tells you everything you want to know about running processes. Download Process Explorer<\/a>, unzip and run the executable.<\/p>\n

For purpose of illustration, I’m launching the System Information Tool (msinfo32.exe) via the Tools tab of the System Configuration Utility (MSConfig.exe).<\/p>\n

<\/p>\n

In Process Explorer, press CTRL+T<\/b> to switch to Tree view (default view) as below. This view shows the list of process started by a parent process.<\/p>\n


Fig 2: msinfo32.exe process created by msconfig.exe<\/i><\/p>\n

Another option would be to double-click the process, and this shows the "Parent" process and its Process Identifier.<\/p>\n

<\/p>\n

Using Process Monitor<\/h2>\n

Process Monitor<\/b> is another stunning tool from Windows SysInternals, which shows what’s running under the hood in real-time. It can track process, file system, registry and network activities in real-time, plus has other useful features. Download Process Monitor<\/a> and run it.<\/p>\n

Click the "Process and Thread Activity" button and disable all other buttons. Press CTRL+E<\/b> to start capture (acts as toggle)<\/p>\n

<\/p>\n

Any process that’s created and terminated from now on, is captured and shown in the display.<\/p>\n

<\/p>\n

There you can see msconfig.exe process launching msinfo.exe.<\/p>\n

Editor’s note:<\/b> This method is very useful in cases where an unknown process runs only for 1 or 2 seconds and remains difficult to track using the earlier tool, Process Explorer. Where as in Process Monitor, it doesn’t matter whether the process is still running or terminated, as everything is recorded already during the span of capture period.<\/p>\n

Happy Computing!<\/p>\n","protected":false},"excerpt":{"rendered":"

You may have come across situations where a continuous hard disk activity taking place although your system being in an idle state. If you open Task Manager out of curiosity, you may find several processes starting and exiting of their own without you doing anything. It could be a scheduled backup task, third-party system maintenance … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-1166","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5946,"url":"https:\/\/www.winhelponline.com\/blog\/program-constantly-writing-hard-disk-io\/","url_meta":{"origin":1166,"position":0},"title":"Find Which Program is Constantly Reading or Writing to Disk","author":"Ramesh","date":"November 4, 2017","format":false,"excerpt":"Does your hard drive LED in the computer's chassis show non-stop disk input or output activity? If the I\/O operations occur at an alarming rate, sometimes even at 100% disk usage, find the process and stop it from running, especially if you're using Solid State Drive. If you're wondering which\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"track disk io usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":3346,"url":"https:\/\/www.winhelponline.com\/blog\/procmon-track-process-creation-exit-time\/","url_meta":{"origin":1166,"position":1},"title":"Track Process Creation and Exit Time Using Process Monitor","author":"Ramesh","date":"June 21, 2016","format":false,"excerpt":"Summary: This post tells you how to track process creation and exit events using the Process Monitor utility. My previous post, List Running Processes, helps you track down currently running processes. And the article Command Prompt Opens and Closes immediately\u00a0tells you if a last run program window was a scheduled\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"process creation and exit time","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/06\/proclist-0.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1646,"url":"https:\/\/www.winhelponline.com\/blog\/find-unknown-program-open-and-close-immediately\/","url_meta":{"origin":1166,"position":2},"title":"Command Prompt Flashes and Closes Quickly at Startup or Random Intervals","author":"Ramesh","date":"February 16, 2016","format":false,"excerpt":"If the Command Prompt, PowerShell, or an unknown program window flashes during logon or at random intervals without you doing anything, there are many chances that it's a Task Scheduler job. The windows popping up frequently can be a huge distraction when you're working or playing a game on the\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"scheduled task list out-gridview - lastruntime","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/02\/schtasks-list-powershell-action-arguments.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":3128,"url":"https:\/\/www.winhelponline.com\/blog\/program-using-internet-resource-monitor\/","url_meta":{"origin":1166,"position":3},"title":"Which Program is Using all of Your Internet Bandwidth? Use Resource Monitor to Find it.","author":"Ramesh","date":"May 22, 2016","format":false,"excerpt":"If you're on a slow or capped connection, keeping an eye on the downloads which might be happening at the background is essential. This post explains how to find which programs are currently accessing the internet or transferring data to and from a remote server, and at what speed. The\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/taskmgr-net-usage-2.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/taskmgr-net-usage-2.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/taskmgr-net-usage-2.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":4527,"url":"https:\/\/www.winhelponline.com\/blog\/view-resources-usage-each-service-svchost-windows-10\/","url_meta":{"origin":1166,"position":4},"title":"View Resources Usage by Individual Services in Windows 10","author":"Ramesh","date":"November 5, 2016","format":false,"excerpt":"With the Windows 10 Creators Update (codenamed \"Redstone 2\") Preview Build 14942, the way in which services are hosted has changed. In Windows 10 v1703 systems with more than 3.5 GB of RAM, each service would get its own service host (svchost.exe), instead of running under a shared service process.\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"svchost separate windows 10","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/services_1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/services_1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/services_1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":42,"url":"https:\/\/www.winhelponline.com\/blog\/configure-task-manager-to-display-full-path-of-running-processes\/","url_meta":{"origin":1166,"position":5},"title":"Task Manager: Show Command-line and Image Path of Running Processes","author":"Ramesh","date":"March 3, 2008","format":false,"excerpt":"Out of all the built-in troubleshooting tools in Windows, Task Manager is probably the most useful tool. Almost every end-user knows what to do when an application stalls. They just fire up Task Manager using Ctrl + Shift + Esc and end the nonresponsive task. Also, Task Manager can be\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"task manager show command line","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/03\/taskmgr_command_line_4.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/1166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=1166"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/1166\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=1166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=1166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=1166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}