Can I use GetOriginator* functions in notifications (which are asynchronous)?
In asynchronous notifications only Process name and Process ID are available and can be retrieved. OriginatorToken is not available. The reason is that Process name and ID are static pieces of information that can be copied to internal structures. Token is a handle to Windows system structures and it can be not available or valid anymore at the moment of notification.