Powershell Explorer: (Get-Process "ProcessName").parent.processname - explorer Sheduler: (Get-Process "ProcessName").parent.processname - svchost