Compare with LAN.
WFP protects system files (typically DLLs and EXEs) by running in the background and detecting attempts to replace protected system files.
The size of each process’s working set is bounded by a minimum number of pages that the Memory Manager guarantees to be resident while the process has one running thread and by a maximum. However, the NT kernel does not necessarily constrain a process’s working set to its maximum if many free pages are available.
See also balance set and quota.