ProcessInformationClass enum

The ProcessInformationClass enumeration specifies the type of information to be queried or set for a process using functions such as NtQueryInformationProcess and NtSetInformationProcess.

Syntax

C++ 
typedef enum _PROCESS_INFORMATION_CLASS {
    ProcessBasicInformation = 0,
    ProcessQuotaLimits = 1,
    ProcessIoCounters = 2,
    ProcessVmCounters = 3,
    ProcessTimes = 4,
    ProcessBasePriority = 5,
    ProcessRaisePriority = 6,
    ProcessDebugPort = 7,
    ProcessExceptionPort = 8,
    ProcessAccessToken = 9,
    ProcessLdtInformation = 10,
    ProcessLdtSize = 11,
    ProcessDefaultHardErrorMode = 12,
    ProcessIoPortHandlers = 13,
    ProcessPooledUsageAndLimits = 14,
    ProcessWorkingSetWatch = 15,
    ProcessUserModeIOPL = 16,
    ProcessEnableAlignmentFaultFixup = 17,
    ProcessPriorityClass = 18,
    ProcessWx86Information = 19,
    ProcessHandleTracing = 20,
    ProcessTakeCharge = 21,
    ProcessLeapSecondInformation = 22,
    ProcessDebugObjectHandle = 23,
    ProcessDebugFlags = 24,
    ProcessHandleInformation = 25,
    ProcessIoPriority = 26,
    ProcessExecuteFlags = 27,
    ProcessTlsInformation = 28,
    ProcessCookie = 29,
    ProcessImageInformation = 30,
    ProcessCycleTime = 31,
    ProcessPagePriority = 32,
    ProcessInstrumentationCallback = 33,
    ProcessThreadStackAllocation = 34,
    ProcessWorkingSetWatchEx = 35,
    ProcessImageFileName = 36,
    ProcessBreakOnTermination = 37,
    ProcessSubsystemInformation = 38,
    ProcessAppCompatFlags = 39,
    ProcessAppCompatFlags2 = 40,
    ProcessChildProcessInformation = 41,
    ProcessInPrivate = 42,
    ProcessPowerState = 43,
    ProcessReserved0 = 44,
    ProcessUseLargePages = 45,
    ProcessResourceManagement = 46,
    ProcessCookie2 = 47,
    ProcessWindowInformation = 48,
    ProcessHandleInformation2 = 49,
    ProcessMitigationPolicy = 50,
    ProcessDynamicCodePolicyInfo = 51,
    ProcessHandleCheckingMode = 52,
    ProcessKeepAliveCount = 53,
    ProcessReclaimMemory = 54,
    ProcessExecuteState = 55,
    ProcessTLSRestart = 56,
    ProcessReserved1 = 57,
    ProcessReserved2 = 58
} PROCESS_INFORMATION_CLASS;

Enumeration Values

ValueDescription
ProcessBasicInformationBasic information about the process.
ProcessQuotaLimitsQuota limits for the process.
ProcessIoCountersI/O counters for the process.
ProcessVmCountersVirtual memory counters.
ProcessTimesTiming information about the process.
ProcessBasePriorityBase priority of the process.
ProcessRaisePriorityRaise the priority of the process.
ProcessDebugPortDebug port associated with the process.
ProcessExceptionPortException port for the process.
ProcessAccessTokenAccess token of the process.
ProcessLdtInformationLocal Descriptor Table information.
ProcessParentProcessIdentifier of the parent process.
ProcessImageFileNamePath to the executable image file.
ProcessBreakOnTerminationIndicates if the process should break on termination.
ProcessSubsystemInformationSubsystem type (e.g., GUI, console).
ProcessAppCompatFlagsCompatibility flags for the process.
ProcessInPrivateIndicates whether the process is in a private namespace.
ProcessMitigationPolicyMitigation policies applied to the process.

Remarks

These values are used with low‑level Native API functions. Most developers should use the higher‑level Win32 API wrappers provided by Windows SDK, such as GetProcessId or SetPriorityClass, instead of directly invoking NtQueryInformationProcess.

Examples

C++ 
#include <windows.h>
#include <winternl.h>

int main() {
    PROCESS_BASIC_INFORMATION pbi;
    ULONG returnLength;
    NTSTATUS status = NtQueryInformationProcess(
        GetCurrentProcess(),
        ProcessBasicInformation,
        &pbi,
        sizeof(pbi),
        &returnLength);
    if (NT_SUCCESS(status)) {
        wprintf(L"Parent Process ID: %u\n", (DWORD)pbi.InheritedFromUniqueProcessId);
    }
    return 0;
}

Related Topics