Kill system processes only enhance the look token privileges of this process, it has debugging rights to: HANDLE hToken, hProcess; TOKEN_PRIVILEGES tp; char * pSEDEBUG = "SeDebugPrivilege"; hProcess = GetCurrentProcess (); OpenProcessToken (hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, & hToken); LookupPrivilegeValue (NULL, pSEDEBUG, & tp.Privileges [0] .Luid); tp.PrivilegeCount = 1; tp.Privileges [0] .Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges (hToken, FALSE, & tp, NULL, NULL, NULL);