>

Find What Spawned a Process (Parent PID)

Trace a suspicious process back to its parent using Win32_Process ParentProcessId.

WindowsProcesseswmisystempowershellLow risk
Run `Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, Name`, then look up the parent with `Get-Process -Id <ParentProcessId>`.

01Command

Command
$ Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, Name    ::  then look up the parent:  Get-Process -Id <ParentProcessId>

02What it does

Every Windows process remembers the PID of the process that created it, stored in Win32_Process.ParentProcessId. Listing ProcessId, ParentProcessId and Name together lets you walk the chain backwards — for example, discovering that a mystery script was launched by Office rather than by Explorer, a classic malware pattern. If the parent PID no longer exists, the parent already exited and only its PID remains as a clue.

03Risk

RiskLow risk
!Warning: PIDs are reused, so an old parent PID may now belong to an unrelated process — cross-check the parent's name before drawing conclusions.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Win32_Process class
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Class definition lists the ParentProcessId uint32 property ('the process ID of the process that created this process') alongside ProcessId and Name.
  • Get-CIMInstance — Get WMI/CIM class instances
    SS64 · technical · 2026-09-17
    Evidence: Shows Get-CimInstance -ClassName <String> syntax for querying WMI classes like Win32_Process, with results piped to Select-Object to pick properties.

Last verified: 2026-09-19 · Category: System & Settings

06Related solutions

Create a scheduled task from CMD with schtasks
WindowsProcessessystemTerminal

Register a recurring Windows task entirely from the command line — ideal for scripts, cleanup jobs, and monitoring probes you want to run unattended.

Medium risk ✓ 2026-09-17
Scan and repair Windows system files with SFC
WindowssystemTerminalDiagnostics

Use the System File Checker to verify every protected Windows system file against known-good copies and automatically replace the damaged ones.

Low risk ✓ 2026-09-17
Install any app from the command line with winget
WindowssystemTerminaldeveloper

Use Windows Package Manager to install, search, and upgrade thousands of applications from the community repository in one command.

Low risk ✓ 2026-09-17