Windows® Internals, Sixth Edition, Part 1

Ppackets, Priority Boosts for Multimedia Applications and Games, The OSI Reference Model, The OSI Reference Model, Protocol Drivers, Network Address Translation, Internet Protocol Security, NDIS Drivers, Connection-Oriented NDIScapturing, Connection-Oriented NDISfiltering by IPSec, Internet Protocol Securityforwarding, Protocol Driversreceive-side scaling, NDIS Driversrouting, The OSI Reference Modelthrottling, Priority Boosts for Multimedia Applications and Gamesunicast, Network Address Translationpage faults, Hardware Interrupt Processing, Software Interrupt Request Levels (IRQLs)exception numbers, Hardware Interrupt Processingpaging data, Virtual Memorypaging files, initialization, Session Manager (Smss)Parameters subkey, Service Applicationsparameters, marshaling, RPC Operationparent partition, Partitions, Synthetic Devices(see also hypervisor (Hyper-V))logical processors, Synthetic Devicesparent processes, Services, Functions, and Routines, Stage 2: Opening the Image to Be Executedabsent, Stage 2: Opening the Image to Be Executedretrieving, Services, Functions, and Routinesparse method, Object Methods, Object Directoriesremote file access, Object Directoriespartitions, Partitions(see also child partitions; parent partition)passive interrupt level, Software Interrupt Request Levels (IRQLs)password-based authentication, Winlogon Initializationpasswords for user logon, Winlogon Initializationpatch descriptors, Hotpatch SupportPatchGuard, Hotpatch Supportpause assembly instruction, SpinlocksPCA (Program Compatibility Assistant), Diagnostic FunctionalityPcb (process control block) member, Data StructuresPCR (processor control region), Software Interrupt Request Levels (IRQLs), TerminationPEB (process environment block), DLL Name Redirection, Processes, Threads, and Jobs, Data Structures, Data Structures, Data Structures, Stage 3D: Concluding the Setup of the Process Address Spaceaddress, Data Structuresfields, Data Structuresfields, viewing, Data Structuressetting up, Stage 3D: Concluding the Setup of the Process Address SpacePeer Content Caching and Retrieval, Configuration, Configuration, Configuration, Configuration, ConfigurationContent Identification, ConfigurationHosted Cache Protocol, ConfigurationHypertext Transfer Protocol (HTTP) Extensions, ConfigurationRetrieval Protocol, ConfigurationPeer Name Resolution Protocol (PNRP), Peer Name Resolution ProtocolPeer-to-Peer Collaboration Interface, Peer-to-Peer InfrastructurePeer-to-Peer Graphing, Peer-to-Peer InfrastructurePeer-to-Peer Grouping, Peer-to-Peer InfrastructurePeer-to-Peer Identity Manager, Peer-to-Peer InfrastructurePeer-to-Peer Infrastructure, Background Intelligent Transfer ServicePeer-to-Peer Namespace Provider, Peer-to-Peer Infrastructureper-processor ready queues, Thread Statesperformance, Security, Emulated Devices, Diagnostic Functionality, Priority Boosts for Multimedia Applications and Games, NDIS Drivers, QoSALPC optimizations, Securityemulated devices, Emulated Devicesnetwork, QoSoffloading operations, NDIS Driversplayback, Priority Boosts for Multimedia Applications and Gamesproblems, detecting and resolving, Diagnostic Functionalityperformance counters, Kernel Mode vs. User Mode, Security, Digging into Windows Internals, Service Descriptor Tables, Memory Virtualization, HKEY_PERFORMANCE_DATAaccessing, Security, HKEY_PERFORMANCE_DATAdescriptions, Digging into Windows InternalsDynamic Memory-related, Memory Virtualizationmode-related, Kernel Mode vs. User ModeSystem Calls/Sec, Service Descriptor TablesPerformance Data Helper (PDH) API and functions, HKEY_PERFORMANCE_DATAperformance diagnostics, Diagnostic FunctionalityPerformance Monitor, Kernel Mode vs. User Mode, Kernel Mode vs. User Mode, Digging into Windows Internals, Digging into Windows Internals, Digging into Windows Internals, Digging into Windows Internals, UBPM API, Examining Thread Activityfunctions, Digging into Windows Internalskernel mode vs. user mode counter, Kernel Mode vs. User Modekernel mode vs. user mode usage, Kernel Mode vs. User Modeperformance counter descriptions, Digging into Windows Internalsproviders, viewing, UBPM APISystem Monitor function, Digging into Windows Internalsthread activity, viewing, Examining Thread ActivityPerformance Options dialog box, Controlling the Quantum, Quantum Settings Registry ValuePerformance tool, Thread States, Priority Boosts for Multimedia Applications and Games, Job Limitsjob objects, viewing, Job Limitsmultimedia thread boosts, viewing, Priority Boosts for Multimedia Applications and Gamesthread state transitions, viewing, Thread Statespermanent objects, Object Securitypermissions, Examining Thread Activity, Determining Accesseffective, viewing, Determining Accessfor protected process threads, Examining Thread Activityphysical layer in OSI reference model, The OSI Reference ModelPhysical Memory counter, Memory Virtualizationphysical memory, mapping to virtual memory, Virtual MemoryPIC (Programmable Interrupt Controller), Hardware Interrupt Processing, x64 Interrupt Controllersviewing, x64 Interrupt Controllerspipelining, Server Message Block and Sub-RedirectorsPipeList, Named Pipe and Mailslot Implementationpipes, establishing, The OSI Reference Model(see also named pipes)PIT (Programmable Interrupt Timer), Asynchronous Procedure Call InterruptsPkgmgr.exe, auto-elevation, Auto-Elevationplatforms, portability across, Architecture OverviewPlug and Play drivers, Windows Driver Model (WDM), Kernel Patch Protectioncode signing, Kernel Patch ProtectionPlug and Play Extensions (PnP-X), Message QueuingPlug and Play manager, Executive, Software Interrupt Request Levels (IRQLs), Dynamic Processor Addition and Replacementdevice interrupt assignment, Software Interrupt Request Levels (IRQLs)dynamic processor support, Dynamic Processor Addition and ReplacementPMP (Protected Media Path), Protected Processes, Protected ProcessesPNRP (Peer Name Resolution Protocol), BranchCache Optimized Application Retrieval: HTTP Sequence, Peer Name Resolution Protocol, Peer Name Resolution Protocol, PNRP Resolution and PublicationID generation, Peer Name Resolution Protocolpeer names, BranchCache Optimized Application Retrieval: HTTP Sequencephases of name resolution, PNRP Resolution and Publicationpoint-to-point communications, The OSI Reference Modelpointers, KPP-protected, Kernel Patch Protectionpolicy settings, viewing, Differences Between Client and Server Versionspolicy-based QoS, QoSPool Monitor, Digging into Windows Internalsport objects, Connection Modelportability, System Architecture, Architecture Overview, Hardware Supportacross hardware architectures, Architecture OverviewHAL and, Hardware Supportports, The OSI Reference ModelPOSIX executables, Stage 2: Opening the Image to Be Executed, Stage 3D: Concluding the Setup of the Process Address Spaceprocess section base address, Stage 3D: Concluding the Setup of the Process Address SpacePOSIX subsystem, Subsystem for Unix-based ApplicationsPostQueuedCompletionStatus API, Reserve Objectspower fail interrupt level, Software Interrupt Request Levels (IRQLs)power management, Intelligent Timer Tick Distributionpower manager, ExecutivePower Options, Windows Driver Model (WDM)PowerPC architecture, Architecture OverviewPowerRequest objects, Executive ObjectsPRCB (processor region control block), Software Interrupt Request Levels (IRQLs), Queued Spinlocks, Thread States, Quantumglobal spinlock pointers, Queued Spinlocksper-processor ready queues and summary, Thread Statesquantum reset value, Quantumpredictable-reads isolation level, Transactional Registry (TxR)preemption, Priority Boosts for Multimedia Applications and Games, Scheduling Scenarios, Idle Threadsidle thread, Idle Threadspreemptive scheduler, Overview of Windows Schedulingprefetching, Stage 7: Performing Process Initialization in the Context of the New Processprefix cache, Multiple UNC Providerpresentation layer in OSI reference model, The OSI Reference Modelpreshutdown notifications, Service Applications, Service ShutdownPreshutdownTimeout parameter, Service Applicationsprevious mode, System Service Dispatchingprimary tokens, Tokensprincipal names, RPC Operationprinter drivers, 32-bit vs. 64-bit, I/O Control Requestspriority boosts, Priority Boosts, Priority Boosts, Priority Boosts, Boosts Due to Scheduler/Dispatcher Events, Unwait Boosts, Unwait Boosts, Unwait Boosts, Lock Ownership Boosts, Priority Boosting After I/O Completion, Priority Boosts for Foreground Threads After Waits, Priority Boosts for Foreground Threads After Waits, Priority Boosts for Foreground Threads After Waits, Priority Boosts After GUI Threads Wake Up, Priority Boosts for CPU Starvation, Priority Boosts for CPU Starvation, Priority Boosts for CPU Starvation, Priority Boosts for CPU Starvation, Applying Boosts, Applying Boosts, Removing BoostsAdjustBoost, Applying BoostsAdjustUnwait, Priority Boosts for CPU StarvationAPC, Unwait Boostsapplying, Priority Boosts for CPU Starvationeffects of, Priority Boosts for CPU Starvationexecutive resources, waiting on, Priority Boosting After I/O Completionfor CPU starvation, Priority Boosts After GUI Threads Wake Upfor multimedia applications and games, Priority Boosts, Removing Boostsforeground threads after waits, Priority Boosts for Foreground Threads After WaitsGUI threads, Priority Boosts for Foreground Threads After WaitsI/O completion, Lock Ownership Boostslock ownership, Unwait Boostsremoving, Applying Boostsscheduler/dispatcher events, Priority Boostsunwait, Boosts Due to Scheduler/Dispatcher Events, Unwait Boostsviewing, Priority Boosts for Foreground Threads After Waits, Priority Boosts for CPU Starvationpriority class, process, Stage 1: Converting and Validating Parameters and Flagspriority levels, Overview of Windows Scheduling, Overview of Windows Scheduling, Priority Levels, Priority Levels, Priority Levels, Priority Levels, Using Tools to Interact with Priority, Using Tools to Interact with Priority, Thread States, Variable Quantums, Priority Boosts, Priority Boosts for CPU Starvation, Preemption, Idle Threads, Idle Threadsboosts, Priority Boostsboosts and quantum length, Variable Quantumschanging, Using Tools to Interact with Priorityidle thread, Idle Threadsinheritance, Priority Levelsmapping of Windows kernel to Windows API, Priority Levelspreemption and, Preemptionpriority 0, Idle Threadsprocess, Using Tools to Interact with Priorityready queues, Thread Statesreal-time range, Priority Levelsrecomputation, Priority Boosts for CPU Starvationthread-scheduling, Overview of Windows Schedulingvs. IRQLs, Priority LevelsPriority Queue, Cache Structurepriority-driven, preemptive scheduling, Thread Scheduling, Scheduling Scenarios(see also thread scheduling)privacy, Background Intelligent Transfer Serviceprivate address spaces, Virtual Memoryprivate namespaces, Object Directoriesprivate objects, Access Checksprivate virtual address spaces, Services, Functions, and Routinesprivilege arrays, Tokensprivileged access control, Securityprivileges, The Local System Account, The Local Service Account, Running with Least Privilege, Integrity Levels, Tokens, Conditional ACEs, Conditional ACEs, Account Rights and Privileges, Account Rights, Account Rights, Privileges, Privileges, Privileges, Super Privileges, Super Privileges, Security Auditingassignment, Account Rights and Privilegesauditing-related, Security AuditingBypass Traverse Checking privilege, Privilegeschecks for, Tokens, Account Rightsdefined, Conditional ACEsenabling and disabling, Privilegesenforcement, Account Rightsexploitation, Super Privilegeslist of, Privilegeslocal system account, The Local System Accountseparating levels of, Integrity Levelsservices, specifying, The Local Service Accountservices, viewing, Running with Least Privilegesuper-user, Super Privilegesproblem scenarios, automated detection and resolution, Windows Diagnostic Infrastructureprocedures, local and remote, RPC Operationprocess activity, viewing, Processes, Threads, and Jobsprocess address space, Processes, Threads, and Jobs, Stage 3A: Setting Up the EPROCESS Object, Stage 3B: Creating the Initial Process Address Space, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structurescreating, Stage 3A: Setting Up the EPROCESS ObjectPEB in, Processes, Threads, and Jobssetting up, Stage 3B: Creating the Initial Process Address SpaceTEB in, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structuresprocess creation, Protected Processes, Flow of CreateProcess, Stage 1: Converting and Validating Parameters and Flags, Stage 1: Converting and Validating Parameters and Flags, Stage 2: Opening the Image to Be Executed, Stage 3E: Setting Up the PEB, Stage 4: Creating the Initial Thread and Its Stack and Context, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Processexecutable file, opening, Stage 1: Converting and Validating Parameters and Flagsexecutive thread object, stack, and context, creating, Stage 3E: Setting Up the PEBflags and parameters, creating and validating, Stage 1: Converting and Validating Parameters and Flagsinitial thread execution, starting, Stage 5: Performing Windows Subsystem–Specific Post-Initializationmain stages, Flow of CreateProcessprocess initialization in context of new process, Stage 7: Performing Process Initialization in the Context of the New Processtracing, Stage 7: Performing Process Initialization in the Context of the New ProcessWindows executive process object creation, Stage 2: Opening the Image to Be ExecutedWindows subsystem–specific post-initialization, Stage 4: Creating the Initial Thread and Its Stack and Contextprocess environment block (PEB), DLL Name Redirection (see PEB (process environment block))Process Explorer, Services, Functions, and Routines, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Digging into Windows Internals, Service Control Manager (SCM), Exception Dispatching, Object Handles and the Process Handle Table, Object Security, Running with Least Privilege, Shared Service Processes, WMI Implementation, Protected Processes, Protected Processes, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Limitations on Protected Process Threads, Worker Factories (Thread Pools), Using Tools to Interact with Priority, Using Tools to Interact with Priority, Security Identifiers, Integrity Levels, Tokens, Privilegesaccess rights, Protected Processescapabilities, Processes, Threads, and Jobsclock cycle counter use, Examining Thread Activityhandle table, viewing, Object Securityhosting processes tooltips, Processes, Threads, and Jobsinformation in, Processes, Threads, and Jobsobject handles, viewing, Object Handles and the Process Handle Tableparent processes, Services, Functions, and Routinespriority levels, changing, Using Tools to Interact with Priorityprivileges, viewing enabled, Privilegesprocess details, viewing, Processes, Threads, and Jobsprocess integrity levels, viewing, Integrity Levelsprotected process threads, viewing, Limitations on Protected Process Threadsprotected processes and, Protected Processesservice processes, viewing details, Service Control Manager (SCM)service security tokens, viewing, Running with Least Privilegeservices running in processes, viewing, Shared Service ProcessesSIDs, viewing, Security Identifierssymbols, accessing, Processes, Threads, and Jobsthread activity, viewing, Examining Thread Activitythread pools, viewing, Worker Factories (Thread Pools)thread stack, displaying, Examining Thread Activitythread startup address, Examining Thread Activitythread user start address, viewing, Exception Dispatchingthreads, killing, Using Tools to Interact with Prioritytoken contents, viewing, TokensWmiprvse creation, viewing, WMI ImplementationWow64 processes, displaying, Examining Thread Activityprocess IDs, Services, Functions, and Routinesprocess manager, Executive, System Worker Threads, CPU Rate LimitsCPU rate limit enforcement, CPU Rate Limitshypercritical work item use, System Worker Threadsprocess memory, changing, Debugging Tools for WindowsProcess Monitor, Digging into Windows Internals, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, DLL Name Redirection, Transactional Registry (TxR), Transactional Registry (TxR), Transactional Registry (TxR), Process Monitor Internals, Process Monitor Troubleshooting Techniques, Stage 7: Performing Process Initialization in the Context of the New Process, Integrity Levelsaccount privileges for, Transactional Registry (TxR)administrative account, running in, Process Monitor Troubleshooting TechniquesDLL search order, viewing, DLL Name RedirectionDPC activity, monitoring, Dispatch or Deferred Procedure Call (DPC) Interruptsinternals, Transactional Registry (TxR)Internet Explorer, tracing, Integrity Levelsinterrupts, monitoring, Dispatch or Deferred Procedure Call (DPC) Interruptsprocess startup, tracing, Stage 7: Performing Process Initialization in the Context of the New Processregistry activity, monitoring, Transactional Registry (TxR)troubleshooting techniques, Process Monitor Internalsprocess notifications, Kernel Patch Protectionprocess object type, Objects and Handles, Executive Objectsprocess objects, Native Support, Data Structures, Data Structurescreation, Native Supportinformation in, displaying, Data Structuresprocess security tokens, Processes, Threads, and Jobsprocess tree, Processes, Threads, and Jobs, Processes, Threads, and JobsProcess Type object, Data Structuresprocess/thread runtime, updating, Timer Expirationprocesses, Services, Functions, and Routines, Services, Functions, and Routines, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Debugging Tools for Windows, Architecture Overview, System Processes, Timer Processing, Windows Error Reporting, Object Methods, Object Methods, Object Handles and the Process Handle Table, Object Retention, Object Retention, Kernel Support, Image Loader, DLL Name Redirection, Hotpatch Support, Services, Service Applications, The Local System Account, Service Isolation, Service Shutdown, Shared Service Processes, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Data Structures, Data Structures, Data Structures, Data Structures, Protected Processes, Protected Processes, Protected Processes, Stage 1: Converting and Validating Parameters and Flags, Stage 1: Converting and Validating Parameters and Flags, Examining Thread Activity, Examining Thread Activity, Worker Factories (Thread Pools), Priority Levels, Using Tools to Interact with Priority, Affinity, Ideal and Last Processor, Dynamic Processor Addition and Replacement, Access Checks, Security Identifiers, Integrity Levels, Tokens, Determining Access, Super Privileges, File System and Registry Virtualizationaccess rights requests, Protected Processesaccess tokens, Super Privilegesaffinity mask, Affinity(see also affinity masks)attaching to, Debugging Tools for Windowsattribute list, Stage 1: Converting and Validating Parameters and Flagsbase priority, Priority Levelsbreaking into, Kernel Supportcomponents, Services, Functions, and RoutinesCPU utilization, Processes, Threads, and Jobs(see also CPU usage)CreateProcess flow, Protected Processes(see also process creation)Csrss-specific information, Data StructuresCSR_PROCESS, Processes, Threads, and Jobsdata structures, Processes, Threads, and Jobsdefined, Services, Functions, and Routinesdetails, viewing, Processes, Threads, and Jobserror port, Windows Error Reportinghandle tables, Object Handles and the Process Handle Table, Access Checkshandles, Object Methods, Data Structureshandles, acquiring, Object Methodshung, Examining Thread Activityideal node, Ideal and Last Processorinitialization, Image Loaderintegrity levels, Security Identifiers, Determining Accessintegrity levels, viewing, Integrity Levelsinternals, Processes, Threads, and Jobsjob objects, Dynamic Processor Addition and Replacementloaded modules database, DLL Name Redirectionmultiple services, running, Service Applicationsnetwork resource access, The Local System Accountopen handles list, Processes, Threads, and Jobsoverhead, Data Structuresparent/child relationships, viewing, Processes, Threads, and Jobs, System Processespriority classes, Stage 1: Converting and Validating Parameters and Flagspriority levels, specifying, Using Tools to Interact with Priorityprotected, Hotpatch Support, Protected Processesquota structure, Object Retentionresources, Processes, Threads, and Jobssecurity context, Processes, Threads, and Jobs, Tokensservices, Services (see services)services running in, viewing, Shared Service Processesshared, Service Shutdownsystem resource access, Object Retentionthreads in, Processes, Threads, and Jobsthreads, viewing, Examining Thread Activitytimer resolution change requests, Timer Processinguser-mode, Architecture Overviewvirtualization status, File System and Registry VirtualizationW32PROCESS, Data Structureswindow stations, Service Isolationwork factory use, viewing, Worker Factories (Thread Pools)processing, Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs)deferring, Software Interrupt Request Levels (IRQLs)real-time, Software Interrupt Request Levels (IRQLs)processor access modes, Kernel Mode vs. User Modeprocessor affinity, Thread Scheduling, Using Tools to Interact with Priority, NUMA Systems, Logical Processor State, Affinity, Extended Affinity Mask, Dynamic Processor Addition and Replacement(see also affinity masks)extended affinity mask, Affinitygroup assignment, NUMA Systemsspecifying, Using Tools to Interact with Prioritysystem affinity mask, Extended Affinity Maskupdating, Dynamic Processor Addition and Replacementprocessor control region (PCR), Software Interrupt Request Levels (IRQLs), Terminationprocessor groups, Symmetric MultiprocessingProcessor Machine State Registers (MSRs), Kernel Patch Protectionprocessor region control block (PRCB), Software Interrupt Request Levels (IRQLs) (see PRCB (processor region control block))processor selection, Thread Selection on Multiprocessor Systemsprocessor share-based scheduling, Choosing a Processor for a Thread When There Are No Idle Processorsprocessor-specific data, Kernel Processor Control Region and Control Block (KPCR and KPRCB)ProcessorAdd callback, Dynamic Processor Addition and Replacementprocessors, Portability, Symmetric Multiprocessing, Symmetric Multiprocessing, Hardware Interrupt Processing, Hardware Interrupt Processing, Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Timer Expiration, Processor Selection, Processor Selection, Intelligent Timer Tick Distribution, Synthetic Devices, Synthetic Devices, Synthetic Devices, Dynamic Processor Addition and Replacement, Dynamic Processor Addition and Replacement(see also logical processors)adding to child partitions, Synthetic DevicesCPU 0, Processor Selectiondynamic, Dynamic Processor Addition and Replacementidle/sleep states, Intelligent Timer Tick DistributionIDT, Hardware Interrupt Processinginterrupt request level settings, Software Interrupt Request Levels (IRQLs)interrupts, Hardware Interrupt ProcessingIRQL, changing, Software Interrupt Request Levels (IRQLs)licensed, Symmetric Multiprocessinglook-aside lists, Dynamic Processor Addition and Replacementmultiple, Portabilitytimer expiration, Timer Expirationtimer selection, Processor Selectiontracking, Symmetric Multiprocessingvirtual, Synthetic Devicesproducers, Kernel SupportProductPolicy registry value, Differences Between Client and Server VersionsProductSuite registry value, Differences Between Client and Server VersionsProductType registry value, Differences Between Client and Server Versionsprofile interrupt level, Software Interrupt Request Levels (IRQLs)profiles, HKEY_USERS, HKEY_USERS, HKEY_USERS, Impersonation, User Logon Steps, File Virtualizationloading and unloading, HKEY_USERSroaming, HKEY_USERS, File Virtualizationsecurity, Impersonationuser, HKEY_USERS, User Logon StepsProgram Compatibility Assistant (PCA), Diagnostic FunctionalityProgrammable Interrupt Timer (PIT), Asynchronous Procedure Call InterruptsProgramming the Microsoft Windows Driver Model, Second Edition (Oney), Windows Driver Kitprograms, Services, Functions, and Routines, Tokens, Running with Administrator Rights(see also executables)defined, Services, Functions, and Routineslow integrity level, launching, TokensProtected Media Path (PMP), Protected Processes, Protected ProcessesProtected Mode Internet Explorer (PIME), Integrity Levels, Determining Accessprotected process threads, Examining Thread Activity, Limitations on Protected Process Threadsinformation, viewing, Limitations on Protected Process Threadslimitations, Examining Thread Activityprotected processes, Hotpatch Support, Protected Processes, Stage 1: Converting and Validating Parameters and Flags, Stage 5: Performing Windows Subsystem–Specific Post-Initializationattribute list, Stage 1: Converting and Validating Parameters and Flagschecks performed on, Stage 5: Performing Windows Subsystem–Specific Post-InitializationProtection Profile (PP), Trusted Computer System Evaluation Criteriaprotocol drivers, Device Drivers, Protocol Drivers, Protocol Drivers, Windows Filtering Platform, Internet Protocol SecurityNDIS driver use, Internet Protocol Securitynetwork, Protocol Driverstransport, Protocol DriversWindows Filtering Platform, Windows Filtering Platformprotocol stack, The OSI Reference Model(see also network stack)providers, Kernel Event Tracing, UBPM API, UBPM API, UBPM API, WMI Architecture, WMI Architecture, WMI Architecture, WMI Architecture, The Common Information Model and the Managed Object Format Language, Multiple Provider Routerbuilt-in, WMI ArchitectureCOM and DCOM servers, WMI Architecturedefined, Multiple Provider Routerdynamic, The Common Information Model and the Managed Object Format Languageevent tracing, Kernel Event Tracinginterface features, WMI ArchitectureUBPM registration, UBPM APIunregistering, UBPM APIviewing, UBPM APIproxies, detecting, Registry Change Monitoringproximity IDs, NUMA SystemsPsAllocateCpuQuotaBlock function, Distributed Fair Share SchedulingPsChargeProcessCpuCycles function, Charging of Cycles to Throttled ThreadsPsCpuFairShareEnabled variable, Distributed Fair Share SchedulingPsCreateSystemThread function, System ProcessesPsGetSid function, Security IdentifiersPsInvertedFunctionTable, Kernel Patch ProtectionPspAllocateProcess function, Stage 2: Opening the Image to Be Executed, Stage 2: Opening the Image to Be ExecutedPspAllocateThread function, Stage 3E: Setting Up the PEBPspCalculateCpuQuota-BlockCycleCredits function, Per-Session CPU Quota BlocksPspCpuQuotaControl data structure, Distributed Fair Share SchedulingPspCreateThread function, Stage 3E: Setting Up the PEB, Birth of a Threadhelper routines, Stage 3E: Setting Up the PEBPspFlushProcessorIdleOnlyQueue function, Resuming ExecutionPspInsertProcess function, Stage 3E: Setting Up the PEBPspInsertThread function, Stage 3E: Setting Up the PEBPspLazyInitializeCpuQuota function, Distributed Fair Share SchedulingPsPrioritySeparation function, Quantum Settings Registry Value, Priority Boosts for Foreground Threads After Waits, Priority Boosts After GUI Threads Wake UpPspStartNewFairShareInterval function, Resuming ExecutionPspUserThreadStartup function, Stage 7: Performing Process Initialization in the Context of the New ProcessPsReleaseThreadFromIdleOnlyQueue routine, Resuming Execution, DFSS Idle-Only Queue Schedulingpublic IP addresses, Protocol Drivers, Network Address Translationprivate address mapping to, Network Address Translationpublication cache, BranchCachepublishing content, BranchCachepushlocks, Executive Resources, Pushlocks, Unwait Boostspriority boosts and, Unwait Boostsstructure, Pushlocks