Client/Server Runtime Subsystem: Difference between revisions

Revision as of 11:12, 14 March 2020

Latest revision as of 03:21, 10 August 2025

(34 intermediate revisions by 19 users not shown)

Line 1:

{{Short description|Windows NT operating system component}}

'''Client Server Runtime Subsystem''', or <tt>csrss.exe</tt>, is a component of the [[Windows NT]] family of [[operating system]]s that provides the [[User space|user mode]] side of the [[Windows API|Win32 subsystem]] and is included in [[Windows NT 3.1]] and later.<ref name="GDI" /> Because most of the Win32 subsystem operations have been moved to [[kernel mode]] [[Device driver|drivers]] in [[Windows NT 4]] and later, CSRSS is mainly responsible for [[Win32 console]] handling and GUI shutdown. It is critical to system operation; therefore, terminating this [[Process (computing)|process]] will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the ''[[kill (command)|taskkill]]'' command or with [[Windows Task Manager]], although it is possible in [[Windows Vista]] if the Task Manager is run in Administrator mode. On [[Windows 7]] and later, Task Manager will inform the user that terminating the process may result in system failure, and prompt if they want to continue.

The '''Client/Server Runtime Subsystem''', or <code>csrss.exe</code>, is a component of the [[Windows NT]] family of [[operating system]]s that provides the [[User space|user mode]] side of the [[Windows API|Win32 subsystem]]. In modern versions of Windows, it is primarily involved with process and thread management, [[Win32 console|console window]] handling, [[side-by-side assembly]] loading and the shutdown process. Historically, it had also been responsible for window management and graphics rendering, however, these operations have been moved to [[kernel mode]] starting with [[Windows NT 4.0]] to improve performance.<ref>{{cite web

== History ==

The [[Windows NT 3.x]] series of releases had placed the [[Graphics Device Interface]] component in CSRSS, but this was moved into kernel mode with Windows NT 4.0 to improve graphics performance.<ref name="GDI">{{cite web

|url=https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120

|title=The Windows NT 4.0 Kernel mode change

|accessdateaccess-date=2009-01-19

|work=MS Windows NT Kernel-mode User and GDI White Paper

|publisher=Microsoft

}}</ref>

}}</ref> The Windows startup process from Vista onward has changed significantly. Two instances of csrss.exe are running in Windows 7 and Vista.<ref>{{cite web

CSRSS instances are marked as critical processes, meaning that terminating one will [[blue screen of death|crash]] the system, if the critical status is removed and one is terminated, the system will freeze. Built-in process management tools in most Windows versions will also refuse to kill instances of CSRSS. Under normal operation, there is a CSRSS instance for each session (two in [[Windows Vista]] and newer, one in earlier versions,<ref>{{cite web

|url=https://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx

|title=Inside the Windows Vista Kernel – Startup Processes

|accessdateaccess-date=2010-10-01

|work=Inside the Windows Vista Kernel – Startup Processes

|publisher=Microsoft

}}</ref> both assuming there are no active [[Remote Desktop Protocol|RDP]] connections which spawn extra sessions).

}}</ref>

== Technical details ==

Line 20 ⟶ 19:

|url=http://www.left-brain.com/tabId/65/itemId/1642/pageId/29/Undocumented-Windows-NT.aspx

|title=Detailed implementation of a system service in Windows NT

|accessdateaccess-date=2010-06-10

|work=Undocumented Windows NT

|archive-url=https://web.archive.org/web/20110717032622/http://www.left-brain.com/tabId/65/itemId/1642/pageId/29/Undocumented-Windows-NT.aspx

|archive-date=2011-07-17

|url-status=dead

}}</ref> Window manager and [[Graphics Device Interface|GDI]] services are handled by a kernel mode driver (win32k.sys) instead.<ref>{{cite book|last=Russinovich|first=Mark|authorlink=Mark Russinovich|title=Windows Internals, 5th Edition|year=2009|publisher=Microsoft Press|pages=54}}</ref>

CSRSS is called along with <ttcode>winlogon.exe</ttcode> from [[Session Manager Subsystem|smss.exe]] at Windows start-up. If either of the files is corrupted or otherwise inaccessible, theSMSS NTwill tell the kernel willto shut down the start-up process with a [[Blue Screenscreen of Deathdeath]].<ref>{{Cite This is caused by web|url=https://support.microsoft.com/en-us/help/156669/how-to-troubleshoot-a kernel-modestop-0xc000021a-error-in-windows-xp-or-windows-s|title=How processto responsibletroubleshoot fora calling"STOP these0xC000021A" fileserror toin "hangWindows up",XP ultimatelyor crashingWindows theServer system2003|website=support.microsoft.com|access-date=2020-03-15}}</ref> The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).

In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns <ttcode>conhost.exe</ttcode> subprocesses to draw console windows for command line programs with the permissions of that user.

== Malware hoaxes ==

There are numerous [[virus hoax]]es that claim that csrss.exe is [[malware]] and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exe [[Process (computing)|process]] will result in a [[Bluesystem Screencrash ofin Death]]Windows applications.

In addition, [[technical support scam]]mers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing their [[rogue security software]] to remove it.<ref>{{cite web|url=http://news.softpedia.com/news/symantec-disavows-business-partner-caught-running-a-tech-support-scam-499310.shtml|title=Symantec Disavows Business Partner Caught Running a Tech Support Scam|last=Cimpanu|first=Catalin|publisher=[[Softpedia]]|date=Jan 22, 2016|accessdateaccess-date=July 29, 2016}}</ref>

== See also ==

Line 45 ⟶ 44:

* [https://technet.microsoft.com/en-us/library/bb457123.aspx Troubleshooting the Startup Process (Windows XP Professional Resource Kit)]

{{Microsoft Windows Componentscomponents}}

{{DEFAULTSORT:Client Server Runtime Subsystem}}