Powershell how to get the ParentProcessID by the ProcessID

As mentioned in the comments, the objects returned from Get-Process (System.Diagnostics.Process) doesn't contain the parent process ID.

To get that, you'll need to retrieve an instance of the Win32_Process class:

PS C:\> $ParentProcessIds = Get-CimInstance -Class Win32_Process -Filter "Name = 'firefox.exe'"
PS C:\> $ParentProcessIds[0].ParentProcessId
3816

In PowerShell Core, the Process object returned by Get-Process cmdlet contains a Parent property which gives you the corresponding Process object for the parent process.

Example:

> $p = Get-Process firefox
> $p.Parent.Id

This worked for me:

$p = Get-Process firefox
$parent = (gwmi win32_process | ? processid -eq  $p.Id).parentprocessid
$parent

The output is the following:

1596

And 1596 is the matching ParentProcessID I've checked it with the ProcessExplorer.


I wanted to get the PPID of the current running PS process, rather than for another process looked up by name. The following worked for me going back to PS v2. (I didn't test v1...)

$PPID = (gwmi win32_process -Filter "processid='$PID'").ParentProcessId
Write-Host "PID: $PID"
Write-Host "PPID: $PPID"

Tags:

Powershell

Recent Posts