Powershell how to get the ParentProcessID by the ProcessID

Question

I've problems to get the ParentProcessID from a Process where I have the ProcessID. I tried it like this, this is how it works with the ProcessID:

$p = Get-Process firefox
$p.Id

But if I try it with the ParentProcessID, it doesn't work:

$p.ParentProcessId

Is there a way to get the ParentProcessID by the ProcessID?

Card

Yes, but not with Get-Process. You need to use CIM/WMI (Win32_Process) – Recollected

gwmi win32_process something like this? – Card

Yes, something like that. Get-CimInstance Win32_Process -Filter "Name = 'firefox.exe'"|select ParentProcessId – Recollected

Yes it works, but I want to select it by the ProcessID I found the solution I'll post it as an anwser, thank you for your help. – Card

Answer 1

This worked for me:

$p = Get-Process firefox
$parent = (gwmi win32_process | ? processid -eq  $p.Id).parentprocessid
$parent

The output is the following:

1596

And 1596 is the matching ParentProcessID I've checked it with the ProcessExplorer.

Card

The equivalent for Powershell Core is (Get-CimInstance CIM_Process | ? processid -eq $p.id).parentProcessId (as Get-WmiObject is deprecated since PowerShell 3 according to https://mcmap.net/q/560028/-what-library-for-powershell-6-contains-the-get-wmiobject-command). – Forehead

Answer 2

As mentioned in the comments, the objects returned from Get-Process (System.Diagnostics.Process) doesn't contain the parent process ID.

To get that, you'll need to retrieve an instance of the Win32_Process class:

PS C:\> $ParentProcessIds = Get-CimInstance -Class Win32_Process -Filter "Name = 'firefox.exe'"
PS C:\> $ParentProcessIds[0].ParentProcessId
3816

Recollected

Answer 3

In PowerShell Core, the Process object returned by Get-Process cmdlet contains a Parent property which gives you the corresponding Process object for the parent process.

Example:

> $p = Get-Process firefox
> $p.Parent.Id

Semiramis

Note that this requires (elevated) administrator privileges. Otherwise it silently fails and the Parent member will be $null. The WMI solution works with less privileges. – Donniedonnish

@Donniedonnish I don't think this is true anymore, it's working for me on a PowerShell without administrative privileges. – Revivify

Answer 4

I wanted to get the PPID of the current running PS process, rather than for another process looked up by name. The following worked for me going back to PS v2. (I didn't test v1...)

$PPID = (gwmi win32_process -Filter "processid='$PID'").ParentProcessId
Write-Host "PID: $PID"
Write-Host "PPID: $PPID"

Scull

Answer 5

PowerShell (Core 6 at least) have CodeProperty Parent on Process.

[System.Diagnostics.Process]::GetCurrentProcess().Parent

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
     53   128,45      68,27     144,38  102672   1 WindowsTerminal

Senescent