Powershell how to get the ParentProcessID by the ProcessID

Question

I've problems to get the ParentProcessID from a Process where I have the ProcessID. I tried it like this, this is how it works with the ProcessID:

$p = Get-Process firefox
$p.Id

But if I try it with the ParentProcessID, it doesn't work:

$p.ParentProcessId

Is there a way to get the ParentProcessID by the ProcessID?

Yes, but not with Get-Process. You need to use CIM/WMI (Win32_Process) — Mathias R. Jessen, Nov 25 '15 at 08:41
Yes, something like that. `Get-CimInstance Win32_Process -Filter "Name = 'firefox.exe'"|select ParentProcessId` — Mathias R. Jessen, Nov 25 '15 at 08:57
Yes it works, but I want to select it by the ProcessID I found the solution I'll post it as an anwser, thank you for your help. — Pascal, Nov 25 '15 at 09:00

score 20 · Answer 1 · answered Nov 25 '15 at 09:01

As mentioned in the comments, the objects returned from Get-Process (System.Diagnostics.Process) doesn't contain the parent process ID.

To get that, you'll need to retrieve an instance of the Win32_Process class:

PS C:\> $ParentProcessIds = Get-CimInstance -Class Win32_Process -Filter "Name = 'firefox.exe'"
PS C:\> $ParentProcessIds[0].ParentProcessId
3816

score 15 · Accepted Answer · answered Nov 25 '15 at 09:05

15

This worked for me:

$p = Get-Process firefox
$parent = (gwmi win32_process | ? processid -eq  $p.Id).parentprocessid
$parent

The output is the following:

And 1596 is the matching ParentProcessID I've checked it with the ProcessExplorer.

answered Nov 25 '15 at 09:05

Pascal

1,255
5
20
44

The equivalent for Powershell Core is `(Get-CimInstance CIM_Process | ? processid -eq $p.id).parentProcessId` (as Get-WmiObject is deprecated since PowerShell 3 according to https://stackoverflow.com/a/54508009/727345). – JonoB Jul 11 '22 at 13:04

score 13 · Answer 3 · answered Jan 03 '19 at 14:56

13

In PowerShell Core, the Process object returned by Get-Process cmdlet contains a Parent property which gives you the corresponding Process object for the parent process.

Example:

> $p = Get-Process firefox
> $p.Parent.Id

answered Jan 03 '19 at 14:56

Rene Hernandez

1,546
13
20

2

Note that this requires (elevated) administrator privileges. Otherwise it silently fails and the `Parent` member will be `$null`. The [WMI solution](https://stackoverflow.com/a/33912191/7571258) works with less privileges. – zett42 Nov 11 '21 at 11:11
1

@zett42 I don't think this is true anymore, it's working for me on a PowerShell without administrative privileges. – Vopel Apr 13 '23 at 22:35

score 2 · Answer 4 · answered Mar 06 '21 at 15:43

I wanted to get the PPID of the current running PS process, rather than for another process looked up by name. The following worked for me going back to PS v2. (I didn't test v1...)

$PPID = (gwmi win32_process -Filter "processid='$PID'").ParentProcessId
Write-Host "PID: $PID"
Write-Host "PPID: $PPID"

Powershell how to get the ParentProcessID by the ProcessID

4 Answers4

Linked