title: Windows processes; how to find orphans from known dead parents?
body: <p>This question may be slightly academic; but yet something puzzling.</p>
  
  <p>Assume on a windows (8+) machine you have a process (in this case a service), say proc_0. I can send a request to this to run something specific. This is done by proc_0 starting (say) proc_a. proc_a then spawns proc_b which in turn may spawn proc_c, which again may spawn proc_d</p>
  
  <p>We'll end up in this process tree:</p>
  
  <p>proc_0<br>
  |_proc_a<br>
  |____proc_b<br>
  |______proc_c<br>
  |________proc_d<br></p>
  
  <p>Let's say I have only influence what happens in proc_b.</p>
  
  <p>Ok, what we want is if proc_a dies, every child of proc_a should die too.</p>
  
  <p>The problem arises if proc_0 kills proc_a. On windows this "orphan" proc_b and it (and its children) stay alive.</p>
  
  <p>Now, proc_b, the one and only process I can decide what to do in, is actually watching what happens, i.e. if proc_a dies it will kill its children. Fine. proc_b may know about proc_c's child proc_d, so it kills that, and then kills proc_c.</p>
  
  <p>But here it goes theoretical.... before proc_c actually got killed by proc_b, proc_c just spawned another child proc_z. proc_b has now no idea of proc_z... which will get orphaned when proc_c eventually dies (remember, I cannot do anything on how proc_c behaves or even if it got killed the hard way for some other reason). Now the processes looks like this:</p>
  
  <p>proc_0<br>
  proc_b (orphaned, but I know)<br>
  proc_z (orphaned, but I dunno)<br></p>
  
  <p>proc_b I can terminate my self, but is there any way to detect that proc_z was actually started by a process I knew about and just killed (i.e. it should die too).</p>
  
  <p>Ok, I can find the orphaned proc_z, but yet, how can I decide if it is ok to kill? proc_z will have no parent process, but might have an old parent pid. Even I could know this pid was actually the one I knew from proc_c, but I have no chance to actually detect if proc_z was actually started by proc_c or a completely different process that also died, where the OS just happened to reuse the pid from my dead proc_c</p>
  
  <p>To relate to reality, this is about what I see on a windows jenkins slave; which caused me to insert proc_b, because cancelling a job leaves subprocesses running. There might be an update to jenkins on this, but the "theoretical" problem - to decide whether to kill this orphan or not - is still in play, I think.</p>