diff --git a/sau/services.py b/sau/services.py
index 275dcd5..a0e3ad6 100644
--- a/sau/services.py
+++ b/sau/services.py
@@ -74,7 +74,7 @@ def restart_services():
 
     # perform a second check to remove potential false positives
     service_procs = set()
-    retest_procs = set()
+    retest_procs = {}
     for proc in check_procs:
         files = _get_deleted_open_files(proc)
         if not files:
@@ -90,11 +90,13 @@ def restart_services():
         log.debug('will attempt to restart parent of {}'.format(proc))
         if len(parents) < 2:
             log.debug('{} is its own top parent'.format(proc))
+            parent = proc
             service_procs.add(proc)
         else:
             log.debug('{} has top parent {}'.format(proc, parents[-2]))
-            service_procs.add(parents[-2])
-        retest_procs.add(proc)
+            parent = parents[-2]
+            service_procs.add(parent)
+        retest_procs[proc] = parent
 
     processes = {}
     services = {}
@@ -114,7 +116,7 @@ def restart_services():
         service_name = conf.get('processes', proc_name, fallback=None)
         if service_name == '':
             log.debug('Ignoring process {}'.format(proc))
-            retest_procs.remove(proc)
+            del retest_procs[proc]
             continue
 
         if not service_name:
@@ -151,7 +153,7 @@ def restart_services():
             platform.restart_service(service)
 
     recommend_restart = False
-    for proc in retest_procs:
+    for proc, parent in retest_procs.items():
         try:
             name = proc.name()
         except (psutil.NoSuchProcess, psutil.ZombieProcess, psutil.AccessDenied):
@@ -164,7 +166,7 @@ def restart_services():
                 recommend_restart = True
                 continue
             elif name in services:
-                policy = _get_service_restart_policy(services[name])
+                policy = _get_service_restart_policy(services[parent.name()])
                 if policy in ('ignore', 'warn'):
                     continue
             log.warning('{} still has deleted files open'.format(proc))