PSCREATEPROCESSNOTIFYTYPE enumeration (ntddk.h)

Indicates the type of process notification. This enumeration is used in PsSetCreateProcessNotifyRoutineEx2 to register callback notifications.

Syntax

typedef enum _PSCREATEPROCESSNOTIFYTYPE {
  PsCreateProcessNotifySubsystems
} PSCREATEPROCESSNOTIFYTYPE;


`PsCreateProcessNotifySubsystems` Indicates that the driver-registered callback is invoked for processes of all subsystems, including the Win32 subsystem. Drivers can call NtQueryInformationProcess to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.