I rely heaviliy on the CommandLine info I get back from WMI, since I know what I started and with which arguments. That might work here.

It would at best be a heuristic. Ie. an informed guess. For exampe, if he needed to run two copies of the daemon concurrently, there would be no way to distinguish between the essentially identical processes started by the two copies. It is also a very expensive way to allow him to continue to use fork.

In this case I was thinking about using the real pid you said came from the forking open and identifying my own from chaining real pid to real ppid.

Once he moves away from using fork and starts using some other mechanism that gives him the real pids--the two I mentioned, or even Win32::Process::Create() etc.--then he will already have a list of real process IDs and can use kill to kill them, so there is no need for WMI or Win32::Process::KillProcess().