VMware ESXi and vSphere Cluster Management

How to View Process Integrity Levels in Process Explorer

Learn what Windows integrity levels mean and how to display and interpret the Integrity column in Process Explorer.

Windows assigns security labels called integrity levels to processes and other securable objects. These labels describe relative trust and help limit what a less-trusted process can modify. Process Explorer can display each running process's integrity level, making it easier to compare normal and elevated applications.

This guide explains Mandatory Integrity Control, common integrity values, how to enable the Integrity column, and how to investigate unexpected results.

What an Integrity Level Means

An integrity level is a Windows security classification associated with a process or securable object. It represents relative trust, not a person's identity. For example, a process can run under an administrator account while still operating at Medium integrity if it was launched without elevation.

Mandatory Integrity Control (MIC) is the Windows security mechanism that uses integrity labels to restrict certain interactions. In general, a lower-integrity process is prevented from modifying a higher-integrity object. This helps reduce the damage that sandboxed, compromised, or otherwise less-trusted code can cause.

Integrity levels work alongside other security controls. They are not a replacement for:

Discretionary permissions: An access control list (ACL) specifies which users or groups may perform actions on an object.
NTFS permissions: File and folder access still depends on the permissions assigned to those files and folders.
User Account Control (UAC): UAC controls how administrative elevation is requested and separated from normal user activity.
Application isolation and sandboxing: Applications may use additional containment techniques.

The exact result of an access request depends on the object's integrity label, its ACL, and the requested operation. Therefore, a lower-integrity process is not necessarily blocked from every read operation; integrity checks are part of a broader access decision.

Common Windows Process Integrity Levels

Integrity level	Typical context	Example launch behavior	General access implication
Low	Restricted or sandboxed execution	An application or helper deliberately launched with reduced rights	Strongly constrained when attempting to modify higher-integrity objects
Medium	Normal interactive desktop applications	Started normally by a standard desktop user	Can perform ordinary user operations, but may not modify protected administrative locations
High	Administrative interactive applications	Started with Run as administrator and approved through UAC	Has a higher integrity context, subject to ACLs and other security controls
System	Core Windows services and operating-system processes	Started by the operating system or service infrastructure	Typically has a highly trusted context, although protection features still apply
Untrusted	Specialized, highly restricted security scenarios	Used by selected isolation designs	More restricted than Low in relevant security decisions

These values are typical rather than absolute. The displayed level can vary with the account type, launch method, UAC configuration, application design, and Windows configuration.

Why Integrity Levels Affect Access

Suppose a Medium-integrity application tries to modify an object protected at a higher integrity level. MIC can block or restrict that modification even when the process's user account might otherwise appear to have useful permissions. This separation helps prevent ordinary applications from changing administrative settings or interfering with more trusted processes.

Integrity level is not the same as:

The account name shown for the process.
Membership in the Administrators group.
Whether the process can access a particular file under its ACL.
Whether the process has every possible administrative privilege.

When troubleshooting access, consider the integrity level together with the process user, token privileges, ACLs, UAC state, executable location, and the exact operation that failed.

Process Explorer and Its Requirements

Process Explorer is a Windows process-inspection utility. Its main window lists running processes and supports configurable columns for details such as the process name, user, command line, parent process, and integrity level.

Basic process inspection usually works without special preparation. Some protected or system processes may expose fewer details unless Process Explorer is run with appropriate administrative authorization. Even with authorization, Windows protection features can limit access to certain process information.

For background on this specific display task, see viewing integrity levels in Process Explorer.

Display the Integrity Column in Process Explorer

Open Process Explorer.
On the menu bar, select View.
Choose Select Columns.
Open the category containing the process-related columns, if categories are shown.
Enable Integrity Level.
Confirm the selection by choosing OK.
Return to the main process list and locate the new Integrity column.

The exact dialog organization or wording can differ slightly between Process Explorer versions. Look for the field named Integrity Level or a very similar label in the process-column options.

Read and Sort the Integrity Values

After the column is enabled, read across a process row from its executable name to the Integrity column. A row might show notepad.exe with Medium, while another row for the same executable shows High.

You can usually sort the list by selecting the Integrity column header. Sorting groups processes with similar values and makes Low, Medium, High, or System entries easier to find. Sorting is useful for an overview, but it does not by itself prove that a process is safe or unsafe.

Multiple instances of the same executable can have different integrity levels. The filename identifies the program image, not necessarily the launch context, user, token, parent process, or elevation state.

Example: Compare Normal and Elevated Notepad

Start Notepad normally from the Start menu or another ordinary launch point.
Open a second Notepad instance by locating Notepad, choosing Run as administrator, and approving the UAC prompt when authorized.
In Process Explorer, ensure that the Integrity column is visible.
Find both notepad.exe entries.
Compare their Integrity values and, if necessary, compare their process IDs and command lines to identify each instance.

Application instance	How it was started	Typical integrity value	Why the value differs
Notepad launched normally	Started without requesting elevation	Medium	The process uses the normal desktop security context
Notepad launched with Run as administrator	Started with administrative elevation and an approved UAC prompt	High	The launch method created an elevated process context

The expected comparison is normally Medium for the first instance and High for the second. The difference comes from how each instance was launched, not from the notepad.exe filename alone.

Use Integrity Levels During Troubleshooting

If an application cannot modify an administrative location, find its process and check the Integrity value. A Medium-integrity application may lack the elevation needed for that operation even when the signed-in user belongs to the Administrators group. If the task is authorized and genuinely requires elevation, relaunch the appropriate application using an approved elevation method.

Correlate the Integrity column with:

The process ID, especially when several instances have the same name.
The user account running the process.
The command line and executable path.
The parent process that started it.
Elevation-related information and available token details.

Interpreting Unexpected Integrity Values

An expected High process shows Medium

The application may have been launched normally, the UAC prompt may have been canceled or not approved, or the selected row may be a non-elevated helper or a different instance. Verify the process name, ID, command line, parent process, and user. Then relaunch the intended application with Run as administrator when appropriate.

A process shows Low

Low integrity can be intentional. Browsers, security tools, and application-isolation features may use restricted processes or helpers. Check the executable path, publisher or signature information, parent process, and command line. Do not treat Low integrity alone as proof of malicious activity.

System processes look different

System and security-protected processes do not always behave like ordinary user applications. Their details may be limited because the process is protected, belongs to another security context, or requires additional inspection privileges. Run Process Explorer with appropriate authorization if permitted, while recognizing that Windows may still restrict visibility.

The same executable has different values

Different launch methods, an elevated and non-elevated instance, or separate helper processes can account for the difference. Compare process IDs, command lines, parent processes, and users rather than assuming that matching executable names mean identical security contexts.

Fix a Missing Integrity Column

Column is off-screen: Maximize or widen the Process Explorer window and scroll horizontally.
Column position is inconvenient: Rearrange visible columns if the installed version supports column repositioning.
Selection was not saved: Reopen View > Select Columns and confirm that Integrity Level remains checked before selecting OK.

Key Takeaways

Integrity levels are Windows trust labels used by Mandatory Integrity Control.
They help restrict lower-integrity processes from modifying higher-integrity objects.
They complement, rather than replace, ACLs, NTFS permissions, UAC, and application isolation.
In Process Explorer, enable the field through View > Select Columns > Integrity Level.
Use the process ID, user, command line, parent process, and elevation information to interpret unexpected values.
Two instances of the same executable can legitimately have different integrity levels.