Return to Answer

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to-

ctrl panel.....administrative tools.....
local security policy......local policies......audit policy

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer..Windows Logs..Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to:

Control Panel -> Administrative Tools -> Local Security Policy -> Local Policies -> Audit Policy If Administrative Tools isn't present in your Control Panel another way to open Local Security Policy is by clicking the Start button and typing secpol.msc.

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer -> Windows Logs -> Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to-

start.....ctrl panel.....administrative tools.....
local security policy......local policies......audit policy

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer..Windows Logs..Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to-

ctrl panel.....administrative tools.....
local security policy......local policies......audit policy

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer..Windows Logs..Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to-

start.....ctrl panel.....administrative tools.....
local security policy......local policies......audit policy

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer..Windows Logs..Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process') in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.

If this was a process that was running in the background, I would probably use the Process Explorer or wmic process approaches outlined by Barlop or Robert Koritnik. If the process is transient and launches/exits very quickly, leaving not enough time to perform the necessary clicks and keystrokes, I would use Process Monitor, as outlined by nixda.

I'm a bit late to this party, but for the sake of completion:

Another alternative to this (if for whatever reason, you don't want to use Process Monitor), is to use the built-in process tracking. This can be enabled by going to-

start.....ctrl panel.....administrative tools.....
local security policy......local policies......audit policy

You should see several auditing options, including Audit Process Tracking. Turn this on for the category of Success.

Now in Event Viewer..Windows Logs..Security, you will see an event for "process creation"(that's event ID 4688), and the name/path of the process being created, and a field called Creator Process ID. This contains the hex representation of the PID of the process which created this process (you can convert this easily using calc.exe in the Programmer view).

You can look for that PID (the PID of that 'creator process' i.e. the PPID) in either Task Manager, or the output of something like tasklist /svc.
If the process is no longer there, you can look for other events with ID 4688 for that other PID, from when it was created.