How can I determine a cmd.exe's parent process

You can use WMI to get this information. The Win32_Process class contains ParentProcessId

So (using PowerShell to execute WMI commands—other WMI tools are available):

gwmi Win32_Process -filter 'processid = 1234' | select ParentProcessId

will give the parent process id of process 1234.


This isn't from within cmd.exe itself but Process Explorer has a tree view which shows parent processes.

alt text