Geoff Chappell - Software Analyst
Windows 8 formalised the nature of the old JobFlags member of the EJOB by putting it in a union with a structure of ULONG bit fields. These have been remarkably stable. With only one exception, all changes just define new bits at the most significant end. By the 1703 release of Windows 10, no spare bits remained and additions continue into a JobFlags2.
| Mask | Definition | Versions |
|---|---|---|
| 0x00000001 |
ULONG CloseDone : 1; |
6.2 and higher |
| 0x00000002 |
ULONG MultiGroup : 1; |
6.2 and higher |
| 0x00000004 |
ULONG OutstandingNotification : 1; |
6.2 and higher |
| 0x00000008 |
ULONG NotificationInProgress : 1; |
6.2 and higher |
| 0x00000010 |
ULONG UILimits : 1; |
6.2 and higher |
| 0x00000020 |
ULONG CpuRateControlActive : 1; |
6.2 and higher |
| 0x00000040 |
ULONG OwnCpuRateControl : 1; |
6.2 and higher |
| 0x00000080 |
ULONG Terminating : 1; |
6.2 and higher |
| 0x00000100 |
ULONG WorkingSetLock : 1; |
6.2 and higher |
| 0x00000200 |
ULONG JobFrozen : 1; |
6.2 and higher |
| 0x00000400 |
ULONG Background : 1; |
6.2 and higher |
| 0x00000800 |
ULONG WakeNotificationAllocated : 1; |
6.2 and higher |
| 0x00001000 |
ULONG WakeNotificationEnabled : 1; |
6.2 and higher |
| 0x00002000 |
ULONG WakeNotificationPending : 1; |
6.2 and higher |
| 0x00004000 |
ULONG LimitNotificationRequired : 1; |
6.2 and higher |
| 0x00008000 |
ULONG ZeroCountNotificationRequired : 1; |
6.2 and higher |
| 0x00010000 |
ULONG CycleTimeNotificationRequired : 1; |
6.2 and higher |
| 0x00020000 |
ULONG CycleTimeNotificationPending : 1; |
6.2 and higher |
| 0x00040000 |
ULONG TimersVirtualized : 1; |
6.2 and higher |
| 0x00080000 |
ULONG JobSwapped : 1; |
6.2 and higher |
| 0x00100000 |
ULONG ViolationDetected : 1; |
6.2 and higher |
| 0x00200000 |
ULONG EmptyJobNotified : 1; |
6.2 and higher |
| 0x00400000 |
ULONG NoSystemCharge : 1; |
6.2 and higher |
| 0x00800000 |
ULONG DropNoWakeCharges : 1; |
6.3 and higher |
| 0x01000000 |
ULONG NoWakeChargePolicyDetected : 1; |
6.3 and higher |
| 0x02000000 |
ULONG NetRateControlActive : 1; |
10.0 and higher |
| 0x04000000 |
ULONG OwnNetRateControl : 1; |
10.0 and higher |
| 0x08000000 |
ULONG IoRateControlActive : 1; |
10.0 and higher |
| 0x10000000 |
ULONG OwnIoRateControl : 1; |
10.0 and higher |
| 0x20000000 |
ULONG IsContainerRoot : 1; |
10.0 only |
ULONG DisallowNewProcesses : 1; |
1511 and higher | |
| 0x40000000 |
ULONG Silo : 1; |
1607 and higher |
| 0x80000000 |
ULONG ContainerTelemetryIdSet : 1; |
1703 and higher |
ULONG SpareJobFlags : 9; |
6.2 only | |
ULONG SpareJobFlags : 7; |
6.3 only | |
ULONG SpareJobFlags : 2; |
10.0 to 1511 | |
ULONG Spare : 1; |
1607 only |
The Silo flag that was added for Version 1607 marks in some sense the completion of Microsoft’s faltering progress from implementing silos as their own type of object, as for the original Windows 10, to making them a special type of job object. Version 1511 had already done away with the silo object: a job is a silo if it has a SILO_CONTEXT pointed to from its Container member. In Version 1607 and higher, the one indicator that a job is a silo is the set Silo bit. If in addition an EJOB has ServerSiloGlobals pointing to an ESERVERSILO_GLOBALS, then the job is specifically a server silo.