Does Windows 7 reuse process IDs?

Question

Does Windows 7 reuse process IDs?

The reason I ask this question is due to my experience that Windows XP and Linux never seems to generate process IDs higher than 20–30k. However, my Windows 7 machine will reach IDs as high as 5–10k or so within a few hours after a reboot, which is my normal experience from the past. The next morning I check and some processes are 250k or higher, which is not.

I activated the security auditing feature to log process creation and termination. Nothing is generating hundreds or thousands or processes. Only 513 of these events are registered for a 24 hour period, yet hundreds of thousands of process IDs have been used, it appears.

I tried a search for my question and one of the suggested questions previously asked pointed to a Mark Russinovich's marvelous blog. But this article, while very interesting reading, has left me puzzled.

Answer 1

From my testing it appears that you have one false assumption, PID numbers are not given out in sequential order. This is very easy to prove, do the following command from the command line. It should open 3 copies of notepad.

notepad & notepad & notepad

On my machine here are the PID's of the 3 copies that where all opened at the same time.

As you can see the PID's jump around a lot, If you open them up one at a time you will also see that the next PID is not always larger than the previous one. For example I opened up a 4th copy of notepad and got this

So it appears that Windows 7 will just pick a random unused PID every time it starts a process, so there very well could have a PID reused throughout the running of windows without a reboot.

---

I wrote up a simple powershell script (requires v2 or newer, see this answers edit history for a C# version) to prove it for sure

$h = new-object 'System.Collections.Generic.HashSet[string]'
do {
    $proc = Start-Process 'notepad' -PassThru
    $id = $proc.Id
    Stop-Process $id
} while ($h.Add($id))
$count = $h.Count
Write-Host "Took $count PIDs to hit a duplicate, the duplicate was $id."

Running the program 10 times it always took between 134 and 147 launches of notepad for the same PID to be re-used (Why is this number so small? GO-GO Gadget Birthday Problem!)

Answer 2

I ran a test for an hour and in that time 302 processes exited. Of those, 70 had a PID in common, so I would say the PID gets reused frequently.