I have written a small process lister that is meant to gather some specific information I want for debugging on a user's machine. It basically gets me anything I want by now except the parent process of a specific process (i.e. the one that started it). Despite the wealth of information offered by the System::Diagnostics::Process and ...::ProcessModule classes I didn't find a way to find that out. (Maybe there's a way to do that using Windows API?)

I know there are apps that are able to do that, like for instance Sysinternals' Process Explorer or my AV. What I don't know is: Do they rely on some service being started earier that monitors process starts (which I would consider overkill in my scenario)? Or do they need to enumerate the entire process tree (which Process Explorer obviously does anyway and might be an effort I'm willing to take)?