Understand Process Terminology

Programs, processes, handles, and threads—what are they, and how do they link together? It can get confusing, particularly given the way that both Task Manager and System Explorer present running programs, processes, and threads.

Programs are a series of files that are combined to provide you with the tools and functionality you use on a daily basis, from a web browser or office package to your game collection. They can also include underlying Windows programs (such as File Explorer) and lower level Services, which work in the background to provide features such as networking and automatic updates.

Processes provide resources to run a program, which are stored in “virtual address space,” a reserved portion of RAM. They comprise the program, open “handles” to system objects, which determine what resources are required (such as DLL files), as well as environment variables. Processes are assigned a security context, which determines their level of access to the system, plus a unique process identifier (PID). They’re also assigned a priority class, which determines how fast the process runs in relation to other processes. Minimum and maximum “working set sizes” are also applied, to set limits on how much physical memory the process requires.

Each process is split into threads, which allows Windows to allocate CPU time between processes. Each thread can execute any part of the process’s code, and shares the process’s virtual address space and resources. They have their own properties, such as unique identifiers and exception handlers, and they stop and start to a schedule, so they don’t all run at once.