View Process Integrity Levels in Process Explorer

Learn how to enable the Integrity Level column in Process Explorer and interpret Low, Medium, High, and System process integrity levels.

Process Explorer can show the integrity level assigned to each running process. This helps you understand whether an application is running with restricted, normal, or elevated trust, which is useful when troubleshooting Windows permission problems.

This lesson assumes basic familiarity with Windows processes and Process Explorer process properties.

What Windows integrity levels mean

An Integrity Level is a trust label associated with a process or securable object. Windows uses this label as part of Mandatory Integrity Control (MIC), a security mechanism that applies integrity-based restrictions in addition to ordinary permissions.

MIC helps limit interactions between processes and objects at different trust levels. In general, a lower-integrity process is restricted from modifying higher-integrity objects. This reduces the ability of a compromised or sandboxed application to affect more trusted applications and system resources.

Integrity levels do not replace ACLs. An Access Control List is the permissions list for a file, registry key, or another securable object. Windows evaluates integrity restrictions alongside ACL permissions, privileges, ownership, protected-process rules, and other security controls.

Common process integrity levels

The exact labels and availability can vary by Windows version, process type, user session, and security context. These are the levels most commonly useful when examining desktop processes.

Integrity level	Typical use or launch context	Example processes	Administrative elevation status
Low	Restricted execution, often used by sandboxed or low-rights processes	Some browser or application sandbox components	Not elevated; more restricted than a normal desktop process
Medium	Normal application started by a standard user without elevation	Notepad started from the Start menu	Not administratively elevated
High	Application launched with administrative elevation	An application started with Run as administrator	Elevated through UAC
System	Windows services and core operating-system processes	Selected service or system processes	Typically associated with system-level execution

Low integrity

Low integrity is a restricted level commonly associated with sandboxed or low-rights execution. A Low process has fewer permitted interactions with objects and processes at higher integrity levels.

Medium integrity

Medium integrity is the normal level for a desktop application launched by a standard user without elevation. Most ordinary applications started normally appear at Medium.

High integrity

High integrity commonly indicates that an application was launched with administrator elevation through UAC, or User Account Control. Choosing Run as administrator and approving the consent prompt normally starts the application with a High integrity token.

System integrity

System integrity is commonly associated with Windows services and core operating-system processes. Do not assume that every service has identical permissions: the process token, service account, privileges, protection rules, and object ACLs still matter.

Show the Integrity Level column in Process Explorer

Open Process Explorer, also called Procexp.
On the menu bar, select View.
Select Select Columns.
In the available process-list columns, locate and enable Integrity Level.
Confirm the dialog. Process Explorer adds the Integrity column to the main process list.

The new column displays the integrity level assigned to each listed process. If the column is difficult to see, resize the Process Explorer window, scroll horizontally, or reposition the column.

For related display settings, see Process Explorer display options.

Read and compare the Integrity column

Find the application in the main Process Explorer window. You can use the process tree, the process name, or other visible columns.
Read the value in the Integrity column for that process.
If several instances have the same executable name, compare their values separately.
Sort the process list by the Integrity column to group or locate Low, Medium, High, or System processes.

An executable name alone does not determine integrity. The launch method, access token, user session, parent process, and sandbox context can cause separate instances of the same executable to have different integrity values.

An access token is security information attached to a process or thread. It includes the user identity, group memberships, privileges, and integrity level. Process Explorer is showing the integrity information associated with the inspected process token.

Example: compare two Notepad processes

This example demonstrates how identical executable files can run at different integrity levels.

Start Notepad normally.
Start a second Notepad instance using Run as administrator. Approve the UAC prompt if Windows displays one.
In Process Explorer, enable the Integrity Level column.
Locate both notepad.exe rows.
Compare their Integrity values.

Executable	Launch method	Expected Integrity value	Reason
`notepad.exe`	Started normally	Medium	The application uses the normal non-elevated desktop token.
`notepad.exe`	Started with Run as administrator	High	UAC provided an administrative access token after elevation was approved.

The two rows can have the same image name while still having different security contexts. The difference comes from how each process was launched and which access token it received.

Practical uses

Identify elevated processes

Enable the Integrity column and sort by it. Review processes marked High and decide whether their elevated state is expected. A High process should be used only when administrative rights are necessary, because a security problem in an elevated application can have greater consequences.

Investigate a permission-related application issue

Find the affected application in Process Explorer.
Check its Integrity value.
Compare it with the integrity level of a related process or target application where applicable.
Review the target file or registry ACL separately before concluding that integrity is the cause.

For more security-context information, see the Process Explorer Security tab.

Security interpretation and limitations

The general MIC principle is that a lower-integrity process is constrained when it attempts to change higher-integrity objects. This can help isolate applications and limit unauthorized modifications.

However, the Integrity column is only one part of an access investigation. A High process can still be denied access because:

The target file, registry key, or other object ACL does not grant the required permission.
The process lacks a required privilege or ownership.
The object is protected by Windows security features or protected-process rules.
An application-specific security control blocks the operation.
The process is using a different user, session, token, or security context than expected.

Likewise, a Medium process may be able to access some objects if their ACLs permit it. Integrity level is a mandatory restriction, not a replacement for discretionary access checks.

Troubleshooting

The Integrity column is not visible

Return to View > Select Columns and enable Integrity Level.
Resize the Process Explorer window if the column is off-screen.
Scroll horizontally or reposition the column if it is outside the visible portion of the process list.

An application expected to be High shows Medium

The application may have been started normally rather than through an elevated launch.
The UAC elevation request may not have been displayed, or it may have been canceled.
You may be inspecting a different child process that did not receive the expected elevated context.

Close the process if appropriate and relaunch it with Run as administrator. Confirm the UAC prompt, then inspect the correct executable instance and its process-tree position.

A High process still cannot access a file or registry location

Check the target object's security permissions and ownership. Also consider required privileges and other Windows or application security mechanisms. High integrity does not prove unrestricted access.

Two copies of the same program show different values

One copy may have been started normally while the other was elevated. Different users, sessions, parent processes, or sandbox conditions can also explain the difference. Compare each process's command line, parent process, user, and launch context in Process Explorer.

Exam-relevant notes

MIC means Mandatory Integrity Control.
Integrity level is a trust classification for processes and securable objects.
Low is restricted, Medium is the usual non-elevated desktop level, and High commonly indicates UAC elevation.
System is commonly associated with Windows services and core system processes.
Integrity restrictions work alongside ACLs; they do not replace file or registry permissions.
Run as administrator normally results in a High integrity process after UAC approval.
The executable name alone does not determine integrity level.