This is not a question of how but more a question of why. In a WFP ClassifyFn during ALE_AUTH_CONNECT or ALE_AUTH_RECV, the FWPS_METADATA_FIELD_PROCESS_ID will return 4 (SYSTEM) for loopback requests while PsGetCurrentProcessId() returns the actual pId (during my testing) of the calling process. Now, I understand that ClassifyFn can run at <= DISPATCH_LEVEL and probably in an arbitrary thread context (although the docs do not specifically say that), but why can’t WFP report the actual process id? Loopback requests still have to go back to the process that made it so it seems like the actual pid should be associated with the request instead of SYSTEM. Hopefully someone from MSFT (Dusty?) can explain how reliable PsGetCurrentProcessId() is during ClassifyFn and if it’s not at all, if there is a way to get the actual process id for a loopback request.