<< Back to Script Library

Get parent process

Retrieves the details of a process's parent process.
A WMI command is invoked to collect the Parent's PID and then used to filter tasklist results
Additional output options REMarked
Version: 1.1.5
Created: 2019-04-03
Modified: 2019-04-03
Creator: mc
Downloads: 165
Tags: process tasklist troubleshooting wmi
The Script Copy Script Copied to clipboard
@ECHO OFF
REM  ====================  Retrieve the Parent Process  ================================
REM  Retrieve the details of a process's parent process. 
REM  A WMI command is invoked to collect the Parent's PID and then used to filter tasklist results
REM  Additional output options REMarked

set PID=%1
ECHO.
ECHO Retriving the Parent process for PID %PID%
ECHO.
for /f "usebackq tokens=2 delims==" %%a in (`wmic process where ^(processid^=%PID%^) get parentprocessid /value`) do set parent=%%a

REM add the /NH switch if you want ot omit the headers
tasklist /FI "PID eq %PARENT%"


REM to get just the executalbe printed out un-REMark the following line:
REM for /f "tokens=1 delims= " %%a in ('tasklist /NH /FI "PID eq %PARENT%"') do ECHO %%a