Windows – How to identify terminated Windows process if I still have its PID

pidprocessprocess-explorerwindowswindows 8

Background: In the middle of my work, license agreement for installing "Microsoft Mouse and Keyboard Center" suddenly appeared. I'd like to understand what process launched the setup, but using Process Explorer, I saw it's gone, I was only able to find its PID (see screenshot).

Question:

If you are using Process Explorer, you perhaps know the situation where parent process of the process no longer exists and you can only see its PID:

enter image description here

Are there some Windows logs containing association of PID to running process so I can find out what process was running under given PID?

Preferably I'm interested in scenarios, where I wasn't expecting this so I did not use Process Monitor to capture events in the system.

Best Answer

Are there some Windows logs containing association of PID to running process

By default there are no such logs. However you can enable Process Tracking Events in the Windows Security Event Log.

Notes:

How to Use Process Tracking Events in the Windows Security Log

In Windows 2003/XP you get these events by simply enabling the Process Tracking audit policy.

In Windows 7/2008+ you need to enable the Audit Process Creation and, optionally, the Audit Process Termination subcategories which you’ll find under Advanced Audit Policy Configuration in group policy objects.

These events are incredibly valuable because they give a comprehensive audit trail of every time any executable on the system is started as a process. You can even determine how long the process ran by linking the process creation event to the process termination event using the Process ID found in both events. Examples of both events are shown below.

enter image description here

Source How to Use Process Tracking Events in the Windows Security Log

How to enable Audit Process Creation

  1. Run gpedit.msc

  2. Select "Windows Settings" > "Security Settings" > "Local Policies" > "Audit Policy"

    enter image description here

  3. Right click "Audit process tracking" and select "Properties"

  4. Check "Success" and click "OK"

    enter image description here

What is Audit Process Tracking

This security setting determines whether the OS audits process-related events such as process creation, process termination, handle duplication, and indirect object access.

If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, both successes and failures, or to not audit these events at all (i.e. neither successes nor failures).

If Success auditing is enabled, an audit entry is generated each time the OS performs one of these process-related activities.

If Failure auditing is enabled, an audit entry is generated each time the OS fails to perform one of these activities.

Default: No auditing

Important: For more control over auditing policies, use the settings in the Advanced Audit Policy Configuration node. For more information about Advanced Audit Policy Configuration, see http://go.microsoft.com/fwlink/?LinkId=140969.

Related Question