Section 6: Process Environment

The Big Picture: The Settings a Process Is Born With

When a person starts a new job, they get a desk (working folder), a set of instructions (command line), a list of company rules (environment variables), an ID badge (user identity) and a manager (parent). A new process gets all of these too. Together they are called its environment: everything around the process that is not its own code or data.

 +---------------------------------------------+
 |                 NEW PROCESS                 |
 |  Environment variables  PATH, TEMP, ...     |
 |  Working directory      C:\Users\You        |
 |  Command line           app.exe -v file.txt |
 |  User identity          YOU (security token)|
 |  Parent                 whoever started it  |
 +---------------------------------------------+

6.1 Environment Variables

What it is: Environment variables are named pieces of text that every program can read. Each is a pair: NAME=value. They hold settings that many programs want to share.

Common ones:

A copy, not a link. When a process is created, it gets its own copy of the variables (normally copied from its parent). If it changes its copy, the parent and other programs do not see the change. Changes pass only downward, to children started afterwards.

 Parent (PATH = A;B)
    |  starts child -> gets copy  (PATH = A;B)
    |  child changes its PATH to  (A;B;C)    <- parent still sees A;B
    +- starts another child later -> gets parent's (A;B)

That is why, after you add something to PATH in Windows settings, programs that are already open do not see it. Close and reopen them (for the new copy).

There are three levels of permanent variables, stored in the registry and read at login: System (all users), User (just you), and the process's own temporary changes. You can edit the first two via Win + R then sysdm.cpl, Advanced, Environment Variables.

Try in Command Prompt: echo %PATH%, set (lists all). In PowerShell: Get-ChildItem Env: and $env:TEMP.

The variables physically sit in the process's own memory (the PEB points to them, Section 2.4).

6.2 Working Directory

What it is: The working directory (also called the current directory) is the folder a process treats as "here". If a program opens a file with a short name like notes.txt, Windows looks for it in the working directory.

By default the child process gets its parent's working directory, unless the parent says otherwise at creation time.

Show it: Command Prompt cd (with no words), PowerShell Get-Location or pwd. Changing it inside one process does not change any other process.

A well-known trap: a program that assumes its working directory equals its own install folder can break when started from somewhere else. Careful programs ask Windows for their own path instead.

Windows also has per-drive current directories (a left-over from old DOS), but you rarely need that detail.

6.3 Command-Line Arguments

What it is: The command line is the text after the program's name, used to tell the program what to do. When Windows creates the process, it stores the whole command line as one string. The program (or its language runtime) then splits it into pieces called arguments.

 notepad.exe  C:\docs\todo.txt
 \_________/  \______________/
   program        argument 1

 robocopy C:\A D:\B /E /Z
 \______/ \__/ \__/ \_/\_/
  program  arg1 arg2 arg3 arg4

Key points:

• Programs read their own command line with a function called GetCommandLine, or through the argc/argv of C/C++, or args in other languages.
• Spaces separate arguments. If a path contains spaces, put it in quotes: "C:\My Docs\a.txt". Without quotes, it breaks into two arguments.
• The meaning of options (/E, -v, --help) is chosen by each program, not by Windows. Windows only hands over the text.
• A command line is visible to other programs that can see the process. So never type passwords on a command line.

See command lines of running processes in PowerShell:

Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine

Task Manager's Details tab also has a Command line column (Select columns).

6.4 Current User Context

What it is: Every process runs as a user. It carries a security token (like an ID badge) that says who started it, which groups the user belongs to and what special rights (privileges) they hold. Windows checks this token every time the process opens a file, a registry key or any other protected thing.

The token is inherited from the parent. So double-clicking a program from Explorer runs it as you. Running it with Run as administrator starts it with a different, stronger token after you approve the prompt (UAC, User Account Control). A process can drop to a weaker token (browsers run web-page helpers with a very restricted one), but cannot raise itself.

Services started by Windows often run as special accounts such as SYSTEM, Local Service or Network Service.

See it: Task Manager Details tab, column User name. In Command Prompt: whoami (and whoami /groups). Another useful column is Elevated (Select columns), which shows Yes when the process is running as admin.

6.5 Parent Process

What it is: The parent process is the process that created this one. Windows records its PID in the child's kernel record as the parent process ID (PPID), as a simple fact at the time of creation.

Why mention it in the environment? Because a child's environment, folder and token come from its parent unless told otherwise (Section 2.5).

Important: the parent PID is only a note. It does not keep the two linked:

• If the parent exits, the child keeps running, and its recorded parent PID stays the same number.
• That number can later match a different process if Windows reuses it.

The full story is in Section 10. See a process's parent in PowerShell:

Get-CimInstance Win32_Process |
  Select-Object ProcessId, ParentProcessId, Name

Summary