Windows Internals

Glossary term

EPROCESS::Protection

The kernel field the process manager and object-access code actually check on every cross-process handle request.

Where EPROCESS::Protection appears

expert

Protected Processes & PPL

A process-launch-time trust label that restricts even SYSTEM-level handle access — not an access check.