I don't believe this should be marked as a duplicate
Here is my scenario. I need to check if an application is running in a RemoteApp session. RemoteApp launches an application menu window which then launches other applications so the chain should be as follows.
rdpinit.exe > appmenu.exe > myapp.exe
So I need to accomplish the following. Check the parent process of myapp.exe which should return appmenu.exe, I then need to know what launched appmenu.exe which should return rdpinit.
btw rdpinit.exe is RemoteApp
I'm doing the following now but can't get to the point where it's rdpinit
public static string IsRemoteApp()
{
Process currentProc = ParentProcessUtilities.GetParentProcess();
do
{
currentProc = GetParentProcess(currentProc.Id);
if (currentProc != null)
{
if (currentProc.ProcessName.Equals("rdpinit"))
{
//return true;
}
}
}
while (currentProc != null);
//return false;
return currentProc.ProcessName;
}
private static Process GetParentProcess(int procId)
{
try
{
string query = string.Format("SELECT ParentProcessId FROM Win32_Process WHERE ProcessId = {0}", procId);
ManagementObjectSearcher search = new ManagementObjectSearcher("root\\CIMV2", query);
ManagementObjectCollection.ManagementObjectEnumerator results = search.Get().GetEnumerator();
if (!results.MoveNext())
{
return null;
}
ManagementBaseObject queryObj = results.Current;
uint parentID = (uint)queryObj["ParentProcessId"];
return Process.GetProcessById((int)parentID);
}
catch
{
return null;
}
}
I have tried just a while loop also
Process currentProc = ParentProcessUtilities.GetParentProcess();
while (GetParentProcess(currentProc.Id) != null)
{
currentProc = GetParentProcess(currentProc.Id);
}
return currentProc.ProcessName;
I can only ever get appmenu.exe
Also what I was thinking which I don't believe this can always be assumed but it might is. Get my session id of myapp, grab process[] of rpdinit. If rdpinit equals the same session id then I can assume it was launched by RemoteApp.
Seems like there can be a scenario where this will be true when the app wasn't actually launched by RemoteApp