Object Names

Kernel-mode objects are either named or unnamed. The object name is a Unicode string that both user-mode and kernel-mode components can use to refer to the object. For example, \KernelObjects\LowMemoryCondition is the name of the standard event object that signals when the amount of free memory in the system is low.

Both user-mode and kernel-mode components use the object name to open a handle to an object. All subsequent operations are performed by using the handle.

If an object is unnamed, a user-mode component cannot open a handle to it. Kernel-mode components can refer to an unnamed object by either a pointer or a handle.

Named objects are organized into a hierarchy. Each object is named relative to a parent object. Each component of the object's name begins with a backslash character. For example, \KernelObjects is the parent object for \KernelObjects\LowMemoryCondition.

Only some types of objects can have child objects. The following are some examples:

• Object directories have child objects. The object manager uses object directories to organize objects. For example \KernelObjects is an object directory that holds standard event objects. Object directories do not correspond to actual directories on a disk. For more information, see Object Directories.

• Device objects for disk drives have child objects that correspond to files on the disk.

• File objects that represent directories have child objects corresponding to files within the directory.

• Device objects for WDM drivers have their own namespace that can be used in a driver-defined fashion. For more information, see Controlling Device Namespace Access.

Files have object names that are relative to \DosDevices. For example, the file C:\Directory\File can be specified as \DosDevices\C:\Directory\File.

For example, the components of the object name can be described as follows.

Drivers that create named objects do so in specific object directories. For more information, see Object Directories.