Edit

PSCREATETHREADNOTIFYTYPE enumeration (ntddk.h)

  • Article

Indicates the type of thread notification. This enumeration is used in PsSetCreateThreadNotifyRoutineEx to register callback notifications associated with thread creation or deletion.

Syntax

typedef enum _PSCREATETHREADNOTIFYTYPE {
  PsCreateThreadNotifyNonSystem,
  PsCreateThreadNotifySubsystems
} PSCREATETHREADNOTIFYTYPE;

Constants

 
PsCreateThreadNotifyNonSystem
The driver-registered callback function is executed on the new non-system thread, which enables the callback function to perform tasks such as setting the initial thread context.
PsCreateThreadNotifySubsystems
Indicates that the driver-registered callback function is invoked for threads of all subsystems. Drivers can call NtQueryInformationThread to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.

Requirements

Requirement Value
Minimum supported client Windows 10, version 1703
Minimum supported server Windows Server 2016
Header ntddk.h (include Ntddk.h)

See also

NtQueryInformationThread

PsSetCreateThreadNotifyRoutineEx

SUBSYSTEM_INFORMATION_TYPE