How to find parent process for child process if parent process is terminated
The Win32_Process
WMI class does tell you the ID of the process that spawned the child process. However, the ParentProcessID is not part of the default property set; you have to specifically ask for it.
PS C:\> Get-WmiObject Win32_Process | Select ProcessID, ParentProcessID | FT -Auto
ProcessID ParentProcessID
--------- ---------------
0 0
4 0
364 4
520 452
576 452
592 584
632 576
640 576
724 632
776 632
840 584
932 632
956 632
1020 632
324 840
508 632
436 632
1120 632
1276 632
It's worth noting however that grandparent process IDs are not tracked.
To get details about any process, please run the following command:
C:\>wmic process list /format:list > process.txt
And then in process.txt
we can locate the orphan processes by ProcessID and also get their ParentProcessID.