PSCREATETHREADNOTIFYTYPE enumeration (ntddk.h)

Indicates the type of thread notification. This enumeration is used in PsSetCreateThreadNotifyRoutineEx to register callback notifications associated with thread creation or deletion.

Syntax

typedef enum _PSCREATETHREADNOTIFYTYPE {
  PsCreateThreadNotifyNonSystem,
  PsCreateThreadNotifySubsystems
} PSCREATETHREADNOTIFYTYPE;

Constants

PsCreateThreadNotifyNonSystem The driver-registered callback function is executed on the new non-system thread, which enables the callback function to perform tasks such as setting the initial thread context.
PsCreateThreadNotifySubsystems Indicates that the driver-registered callback function is invoked for threads of all subsystems. Drivers can call NtQueryInformationThread to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.

Requirements

Requirement	Value
Minimum supported client	Windows 10, version 1703
Minimum supported server	Windows Server 2016
Header	ntddk.h (include Ntddk.h)

See also

NtQueryInformationThread

PsSetCreateThreadNotifyRoutineEx

SUBSYSTEM_INFORMATION_TYPE