I use Process Monitor from SysInternals to view logs from users' when they're being unable to launch an application. Very often users are running various security software they're not even aware of, and I will try to figure out if any of these are the cause of the process early termination.
But as far as I can tell, there is no way to see in ProcMon what process is responsible for terminating another. The only thing I've found when testing is a reference to QueryNameInformationFile from the terminating process to the one being terminated.
Is there a way to tell this from the ProcMon logs, or do I need to use some other tools for figuring this out?
