How to determine the process initiator?

Question

PowerShell

The task consists in the following:
We have electronic document management. It is necessary to keep track of whether its window is active and, in case of inactivity, give the user N time before closing it. I catch the active window by handle, which I get from the GetForegroundWindow function, but when the user opens a certain document, for example, WORD becomes the active window and the timer starts, although in fact the user still works in EDF. Is it possible to determine that the initiator of the launch of the WORD process was the EDI process?

Answer 1

gwmi win32_process | where description -match "notepad" | select parentprocessid | %{Get-Process | where id -EQ $_.parentprocessid | select name, id} will return the name and PID of the notepad's parent. it's all in one line.