Source/Get-ParentProcess.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<#
.SYNOPSIS
Returns parent process of a process ID
 
.DESCRIPTION
A recursive function that finds top parent process of a process ID in the process tree .
 
.PARAMETER ID
Process ID to find the parent process
 
.EXAMPLE
Get-ParentProcess -ID $PID
#>

Function Get-ParentProcess{
    Param(
        $ID = $PID
    )
    $Process = Get-WmiObject Win32_Process -Filter $("ProcessId = '{0}'" -f $ID)

    if(get-process -id $Process.ParentProcessId -ErrorAction SilentlyContinue) {
        $parent = Get-ParentProcess($Process.parentProcessid)

        # if no parents found further then print the [System.Diagnostics.Process] object
        if(-not $parent){
            Get-Process -Id $Process.ProcessId
        }

        return $parent
    }
}