title: Intercepting process execution in a NT driver
body: <p>I have developed a driver for Windows XP which is able to monitor the execution of processes.</p>
  
  <p>A callback function receives the notifications using standard WDK API (PsSetCreateProcessNotifyRoutine).</p>
  
  <p>The driver then decides if the process should be authorized or not; if not, it must block its execution/kill it.</p>
  
  <p>What is the cleanest way to intercept execution that way? I do not mind if it is not documented, but I would rather not resort to hooking, if possible.</p>