Application started by user or another application?

Question

Hey everyone,

This is a very general question: I was wondering whether it is possible to find out whether an application (any kind of application no matter if it a delphi-application or java or whatever) was started by a user or by another application? And if it is possible and I see that an application was called by another one, can I find out what the "father" application is, that called the new programm?

Thnx in advance!

EDIT: Maybe it is too general - How can I see whether a Delphi application has a parent application with Delphi itself, e.g. one application was started by a service and I need to find that service?

Answer 1

You don't mention if you want to do this programmatically or if you're looking for a tool to just show the information.

If you just want to view the information, you can use Process Monitor, part of SysInternals:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

In the Tools menu, there is a 'Process Tree' view that shows you a tree with parent / child process relationships and as well as the owner of each process.

If you want even more detail about processes, look at Process Explorer:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Answer 2

if it started by the user from windows so the parent will be explorer.exe, otherwise the parent will be the application which run the process. to check the parent of a process by using tool check Ander Miller reply.

Answer 3

Every single running application has a parent application, which launched it (except for root system process).

It is not possible to tell, whenever it is user who directly clicked on application to lauch it or not.

Example: take Explorer shell (not Internet Explorer).

1. You can double click on any application to launch it. The parent process will be explorer.exe.

2. You can right-click on any file and a bunch of context menu extenders will load. Some of them may launch external applications to, say, create a preview of video-file (I saw this, swear!). The parent process will be explorer.exe, but user didn't indended to lauch any application. He just wants to view file's properties. He didn't even know, that applications were lauched!

Example: take Total Commander or any other two-panel file managers, which supports plugins for archives.

1. You can double click on any application to launch it. The parent process will be totalcmd.exe.
2. You may enter archive file and copy (extract) few files from it to your Documents folders. Corresponding plugin may handle extraction by itself or run invisible process to handle all work. All you see is progress bar in Total Commander. But there is a new proces and its parent is totalcmd.exe again.

There are no differences between cases 1 and 2 in both examples.

BTW, the definition "started by user" is unclear. You even may say that nothing can happen without user's command. All those background processes in cases #2 were launched because user asked for it. Well, user didn't asked for lauch explicitly, but he asked for operation itself.

Answer 4

Did you see this question? I'm not sure that I see problem right now.