The SYSTEM_INFORMATION_CLASS is an enumeration whose values are intended as input to the ZwQuerySystemInformation, ZwQuerySystemInformationEx and ZwSetSystemInformation functions. Different values select different types of information to query or set.

Documentation Status

Microsoft has kept SYSTEM_INFORMATION_CLASS remarkably private. Analogues for information about files, processes, threads, and much else, have all their supported values defined in header files from as far back as the Device Driver Kit (DDK) for Windows NT 3.51. Even as late as the Windows Driver Kit (WDK) for Windows 10, however, SYSTEM_INFORMATION_CLASS has no C-language definition in any WDK header.

The closest that Microsoft has come to formal disclosure of the SYSTEM_INFORMATION_CLASS enumeration is some plainly reluctant documentation of NtQuerySystemInformation and a C-language definition of the enumeration in the WINTERNL.H file from the Software Development Kit (SDK) for user-mode programming. This header was added to the SDK in 2002, apparently for Microsoft’s compliance with a settlement concerning unfair use of internal Windows APIs by “middleware” products such as Internet Explorer. Better late than never, it might be argued, except that neither the documentation’s listing nor the header’s definition of SYSTEM_INFORMATION_CLASS is anywhere near complete. Perhaps Microsoft felt compelled to disclose only the cases that Microsoft found its middleware using, but whatever the reason, the disclosure was not so much partial as greatly reduced—to just nine values, increased to 10 in the SDK for Windows 8.1, and to 12 for the documentation online as found today, 28th October 2016, but dating from who knows when.

Microsoft’s names for all the hundreds of SYSTEM_INFORMATION_CLASS values have slipped out, of course. As usual when it comes to Microsoft’s names for otherwise undocumented material, they’re knowable from type information in symbol files. Not at all usual is which symbol files—not for the kernel, where the enumeration is interpreted and the relevant functions are implemented, nor even NTDLL, but for various higher-level user-mode DLLs. The most conspicuous is URLMON.DLL, for it is a component of Internet Explorer, i.e., of the most prominent “middleware” that compelled even the grudgingly partial disclosure in 2002. The symbol files that have been publicly available for URLMON since 2012 show that it is built not with the reduced SYSTEM_INFORMATION_CLASS from WINTERNL.H but with the whole thing. However URLMON was built in the years when Microsoft’s compliance with the settlement was reviewed by—it might be hoped—competent regulators, URLMON evidently is built now with more knowledge of low-level Windows than Microsoft publishes even for kernel-mode device driver programmers. Do not tell me that there was not at Microsoft somewhere some time someone who enjoyed mocking the government and courts over this. (I say this as criticism of the latter very much more than of Microsoft.)

Much further back, it turns out that type information for the SYSTEM_INFORMATION_CLASS was disclosed in statically linked libraries that Microsoft distributed with early DDKs: a GDISRVL.LIB in the DDK for Windows NT 3.51; and SHELL32.LIB in the DDK for Windows NT 4.0. The latter is otherwise just an import library for SHELL32.DLL suggests strongly that this disclosure, if not these disclosures, were one-off oversights.


Of the very many defined cases, some can be used successfully only to query or only to set. Some can’t usefully be called either way—at least, not in all versions. The present purpose however is not to show which values are implemented non-trivially in which versions, but which values are defined in which versions, as much as can be known. For Windows 8 through Windows 10, the URLMON.PDB in Microsoft’s packages of symbol files is surely definitive. Whether a symbol is defined for an earlier version is inferred from comparison against the upper limit that the functions apply. This suffices for a rough history of the development, at best, for although it seems reasonable to suppose that values above this limit were not yet defined, values below may have been defined differently or not at all.

Numeric Value Symbolic Name Versions
0x00 SystemBasicInformation 3.10 and higher
0x01 SystemProcessorInformation 3.10 and higher
0x02 SystemPerformanceInformation 3.10 and higher
0x03 SystemTimeOfDayInformation 3.10 and higher
0x04 SystemPathInformation 3.10 and higher
0x05 SystemProcessInformation 3.10 and higher
0x06 SystemCallCountInformation 3.10 and higher
0x07 SystemDeviceInformation 3.10 and higher
0x08 SystemProcessorPerformanceInformation 3.10 and higher
0x09 SystemFlagsInformation 3.10 and higher
0x0A SystemCallTimeInformation 3.10 and higher
0x0B SystemModuleInformation 3.10 and higher
0x0C SystemLocksInformation 3.10 and higher
0x0D SystemStackTraceInformation 3.10 and higher
0x0E SystemPagedPoolInformation 3.10 and higher
0x0F SystemNonPagedPoolInformation 3.10 and higher
0x10 SystemHandleInformation 3.10 and higher
0x11 SystemObjectInformation 3.10 and higher
0x12 SystemPageFileInformation 3.10 and higher
0x13 SystemVdmInstemulInformation 3.10 and higher
0x14 SystemVdmBopInformation 3.10 and higher
0x15 SystemFileCacheInformation 3.10 and higher
0x16 SystemPoolTagInformation 3.50 and higher
0x17 SystemInterruptInformation 3.50 and higher
0x18 SystemDpcBehaviorInformation 3.50 and higher
0x19 SystemSpare3Information 3.50 to 3.51;
name from GDISRVL.LIB in 3.51
SystemFullMemoryInformation 4.0 and higher
0x1A SystemLoadGdiDriverInformation 3.50 and higher
0x1B SystemUnloadGdiDriverInformation 3.50 and higher
0x1C SystemTimeAdjustmentInformation 3.50 and higher
0x1D SystemSpare6Information 3.50 to 3.51;
name from GDISRVL.LIB in 3.51
SystemSummaryMemoryInformation 4.0 and higher
0x1E SystemNextEventIdInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemMirrorMemoryInformation 3.50 and higher
0x1F SystemEventIdsInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemPerformanceTraceInformation 3.50 and higher
0x20 SystemCrashDumpInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemObsolete0 3.50 and higher
0x21 SystemExceptionInformation 3.50 and higher
0x22 SystemCrashDumpStateInformation 3.50 and higher
0x23 SystemKernelDebuggerInformation 3.50 and higher
0x24 SystemContextSwitchInformation 3.50 and higher
0x25 SystemRegistryQuotaInformation 3.51 and higher
0x26 SystemExtendServiceTableInformation 3.51 and higher
0x27 SystemPrioritySeperation 3.51 and higher
0x28 SystemPlugPlayBusInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemVerifierAddDriverInformation 3.51 and higher
0x29 SystemDockInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemVerifierRemoveDriverInformation 3.51 and higher
0x2A SystemPowerInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemProcessorIdleInformation 4.0 and higher
0x2B SystemProcessorSpeedInformation name from GDISRVL.LIB in 3.51;
name from SHELL32.LIB in 4.0
SystemLegacyDriverInformation 4.0 and higher
0x2C SystemCurrentTimeZoneInformation 4.0 and higher
0x2D SystemLookasideInformation 4.0 and higher
0x2E SystemTimeSlipNotification 5.0 and higher
0x2F SystemSessionCreate 5.0 and higher
0x30 SystemSessionDetach 5.0 and higher
0x31 SystemSessionInformation 5.0 and higher
0x32 SystemRangeStartInformation 5.0 and higher
0x33 SystemVerifierInformation 5.0 and higher
0x34 SystemVerifierThunkExtend 5.0 and higher
0x35 SystemSessionProcessInformation 5.0 and higher
0x36 SystemLoadGdiDriverInSystemSpace 5.0 from Windows 2000 SP4, and higher
0x37 SystemNumaProcessorMap 5.0 from Windows 2000 SP4, and higher
0x38 SystemPrefetcherInformation 5.1 and higher
0x39 SystemExtendedProcessInformation 5.1 and higher
0x3A SystemRecommendedSharedDataAlignment 5.1 and higher
0x3B SystemComPlusPackage 5.1 and higher
0x3C SystemNumaAvailableMemory 5.1 and higher
0x3D SystemProcessorPowerInformation 5.1 and higher
0x3E SystemEmulationBasicInformation 5.1 and higher
0x3F SystemEmulationProcessorInformation 5.1 and higher
0x40 SystemExtendedHandleInformation 5.1 and higher
0x41 SystemLostDelayedWriteInformation 5.1 and higher
0x42 SystemBigPoolInformation 5.1 from Windows XP SP2, and higher
0x43 SystemSessionPoolTagInformation 5.1 from Windows XP SP2, and higher
0x44 SystemSessionMappedViewInformation 5.1 from Windows XP SP2, and higher
0x45 SystemHotpatchInformation 5.1 from Windows XP SP2, and higher
0x46 SystemObjectSecurityMode 5.1 from Windows XP SP2, and higher
0x47 SystemWatchdogTimerHandler 5.1 from Windows XP SP2, and higher
0x48 SystemWatchdogTimerInformation 5.1 from Windows XP SP3, and higher
0x49 SystemLogicalProcessorInformation 5.1 from Windows XP SP3, and higher
0x4A SystemWow64SharedInformationObsolete 5.2 from Windows Server 2003 SP1, and higher
0x4B SystemRegisterFirmwareTableInformationHandler 5.2 from Windows Server 2003 SP1, and higher
0x4C SystemFirmwareTableInformation 5.2 from Windows Server 2003 SP1, and higher
0x4D SystemModuleInformationEx 5.2 from Windows Server 2003 SP1, and higher
0x4E SystemVerifierTriageInformation 5.2 from Windows Server 2003 SP1, and higher
0x4F SystemSuperfetchInformation 5.2 from Windows Server 2003 SP1, and higher
0x50 SystemMemoryListInformation 5.2 from Windows Server 2003 SP1, and higher
0x51 SystemFileCacheInformationEx 5.2 from Windows Server 2003 SP1, and higher
0x52 SystemThreadPriorityClientIdInformation 6.0 and higher
0x53 SystemProcessorIdleCycleTimeInformation 6.0 and higher
0x54 SystemVerifierCancellationInformation 6.0 and higher
0x55 SystemProcessorPowerInformationEx 6.0 and higher
0x56 SystemRefTraceInformation 6.0 and higher
0x57 SystemSpecialPoolInformation 6.0 and higher
0x58 SystemProcessIdInformation 6.0 and higher
0x59 SystemErrorPortInformation 6.0 and higher
0x5A SystemBootEnvironmentInformation 6.0 and higher
0x5B SystemHypervisorInformation 6.0 and higher
0x5C SystemVerifierInformationEx 6.0 and higher
0x5D SystemTimeZoneInformation 6.0 and higher
0x5E SystemImageFileExecutionOptionsInformation 6.0 and higher
0x5F SystemCoverageInformation 6.0 and higher
0x60 SystemPrefetchPatchInformation 6.0 and higher
0x61 SystemVerifierFaultsInformation 6.0 and higher
0x62 SystemSystemPartitionInformation 6.0 and higher
0x63 SystemSystemDiskInformation 6.0 and higher
0x64 SystemProcessorPerformanceDistribution 6.0 and higher
0x65 SystemNumaProximityNodeInformation 6.0 and higher
0x66 SystemDynamicTimeZoneInformation 6.0 and higher
0x67 SystemCodeIntegrityInformation 6.0 and higher
0x68 SystemProcessorMicrocodeUpdateInformation 6.0 from Windows Vista SP1, and higher
0x69 SystemProcessorBrandString 6.0 from Windows Vista SP1, and higher
0x6A SystemVirtualAddressInformation 6.0 from Windows Vista SP1, and higher
0x6B SystemLogicalProcessorAndGroupInformation 6.1 and higher
0x6C SystemProcessorCycleTimeInformation 6.1 and higher
0x6D SystemStoreInformation 6.1 and higher
0x6E SystemRegistryAppendString 6.1 and higher
0x6F SystemAitSamplingValue 6.1 and higher
0x70 SystemVhdBootInformation 6.1 and higher
0x71 SystemCpuQuotaInformation 6.1 and higher
0x72 SystemNativeBasicInformation 6.1 and higher
0x73 SystemErrorPortTimeouts 6.1 and higher
0x74 SystemLowPriorityIoInformation 6.1 and higher
0x75 SystemBootEntropyInformation 6.1 and higher
0x76 SystemVerifierCountersInformation 6.1 and higher
0x77 SystemPagedPoolInformationEx 6.1 and higher
0x78 SystemSystemPtesInformationEx 6.1 and higher
0x79 SystemNodeDistanceInformation 6.1 and higher
0x7A SystemAcpiAuditInformation 6.1 and higher
0x7B SystemBasicPerformanceInformation 6.1 and higher
0x7C SystemQueryPerformanceCounterInformation 6.1 from Windows 7 SP1, and higher
0x7D SystemSessionBigPoolInformation 6.2 and higher
0x7E SystemBootGraphicsInformation 6.2 and higher
0x7F SystemScrubPhysicalMemoryInformation 6.2 and higher
0x80 SystemBadPageInformation 6.2 and higher
0x81 SystemProcessorProfileControlArea 6.2 and higher
0x82 SystemCombinePhysicalMemoryInformation 6.2 and higher
0x83 SystemEntropyInterruptTimingInformation 6.2 and higher
0x84 SystemConsoleInformation 6.2 and higher
0x85 SystemPlatformBinaryInformation 6.2 and higher
0x86 SystemThrottleNotificationInformation 6.2 only
SystemPolicyInformation 6.3 and higher
0x87 SystemHypervisorProcessorCountInformation 6.2 and higher
0x88 SystemDeviceDataInformation 6.2 and higher
0x89 SystemDeviceDataEnumerationInformation 6.2 and higher
0x8A SystemMemoryTopologyInformation 6.2 and higher
0x8B SystemMemoryChannelInformation 6.2 and higher
0x8C SystemBootLogoInformation 6.2 and higher
0x8D SystemProcessorPerformanceInformationEx 6.2 and higher
0x8E SystemSpare0 6.2 and higher
0x8F SystemSecureBootPolicyInformation 6.2 and higher
0x90 SystemPageFileInformationEx 6.2 and higher
0x91 SystemSecureBootInformation 6.2 and higher
0x92 SystemEntropyInterruptTimingRawInformation 6.2 and higher
0x93 SystemPortableWorkspaceEfiLauncherInformation 6.2 and higher
0x94 SystemFullProcessInformation 6.2 and higher
0x95 SystemKernelDebuggerInformationEx 6.3 and higher
0x96 SystemBootMetadataInformation 6.3 and higher
0x97 SystemSoftRebootInformation 6.3 and higher
0x98 SystemElamCertificateInformation 6.3 and higher
0x99 SystemOfflineDumpConfigInformation 6.3 and higher
0x9A SystemProcessorFeaturesInformation 6.3 and higher
0x9B SystemRegistryReconciliationInformation 6.3 and higher
0x9C SystemEdidInformation 6.3 and higher
0x9D SystemManufacturingInformation 10.0 and higher
0x9E SystemEnergyEstimationConfigInformation 10.0 and higher
0x9F SystemHypervisorDetailInformation 10.0 and higher
0xA0 SystemProcessorCycleStatsInformation 10.0 and higher
0xA1 SystemVmGenerationCountInformation 10.0 and higher
0xA2 SystemTrustedPlatformModuleInformation 10.0 and higher
0xA3 SystemKernelDebuggerFlags 10.0 and higher
0xA4 SystemCodeIntegrityPolicyInformation 10.0 and higher
0xA5 SystemIsolatedUserModeInformation 10.0 and higher
0xA6 SystemHardwareSecurityTestInterfaceResultsInformation 10.0 and higher
0xA7 SystemSingleModuleInformation 10.0 and higher
0xA8 SystemAllowedCpuSetsInformation 10.0 and higher
0xA9 SystemDmaProtectionInformation 10.0 and higher
0xAA SystemInterruptCpuSetsInformation 10.0 and higher
0xAB SystemSecureBootPolicyFullInformation 10.0 and higher
0xAC SystemCodeIntegrityPolicyFullInformation 10.0 and higher
0xAD SystemAffinitizedInterruptProcessorInformation 10.0 and higher
0xAE SystemRootSiloInformation 10.0 and higher
0xAF SystemCpuSetInformation 10.0 and higher
0xB0 SystemCpuSetTagInformation 10.0 and higher
0xB1 SystemWin32WerStartCallout 1511 and higher
0xB2 SystemSecureKernelProfileInformation 1511 and higher
0xB3 SystemCodeIntegrityPlatformManifestInformation 1607 and higher
0xB4 SystemInterruptSteeringInformation 1607 and higher
0xB5 SystemSuppportedProcessorArchitectures 1607 and higher
0xB6 SystemMemoryUsageInformation 1607 and higher
0xB7 SystemCodeIntegrityCertificateInformation 1607 and higher
0xB8 SystemPhysicalMemoryInformation 1703 and higher
0xB9 SystemControlFlowTransition 1703 and higher
0xBA SystemKernelDebuggingAllowed 1703 and higher
0xBB SystemActivityModerationExeState 1703 and higher
0xBC SystemActivityModerationUserSettings 1703 and higher
0xBD SystemCodeIntegrityPoliciesFullInformation 1703 and higher
0xBE SystemCodeIntegrityUnlockInformation 1703 and higher
0xBF SystemIntegrityQuotaInformation 1703 and higher
0xC0 SystemFlushInformation 1703 and higher
0xC1 SystemProcessorIdleMaskInformation 1709 and higher
0xC2 SystemSecureDumpEncryptionInformation 1709 and higher
0xC3 SystemWriteConstraintInformation 1709 and higher
0x95 (6.2);
0x9D (6.3);
0xB1 (10.0);
0xB3 (1511);
0xB8 (1607);
0xC1 (1703);
0xC4 (1709)

The spelling of SystemPrioritySeperation (0x27) is Microsoft’s.

The change of name for case 0x86 is what’s shown in the symbol files. The implementation in version 6.2 is consistent with SystemPolicyInformation in subsequent versions. The original name, SystemThrottleNotificationInformation, at best remains from some other use that was dropped during development.