I am killing some tasks within cmd using following command:
taskkill /f /im software* /t
It does the job and kills all the tasks with that IMAGENAME; but, looking at what it gave me, I saw something interesting. Look below:
SUCCESS: The process with PID 14712 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 12184 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 16344 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 6816 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 10656 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 14912 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 11908 (child process of PID 9068) has been terminated. SUCCESS: The process with PID 9068 (child process of PID 10060) has been terminated.
So, as expected, all the processes are attached to one centralize task PID = 9068. But then, that process is also a child process of PID = 10060 which is the PID of explorer.exe. This job has no GUI. So I am surprised to see that it is a child process of explorer.
So, here's a question: What kind of processes will be under explorer.exe in windows?
Update:
Question: If I want to avoid closing (using taskkill) any process that is, directly or indirectly, a child process of explorer.exe, how would I approach that?