|
The '''Client /Server Runtime Subsystem''', or <code>csrss.exe</code>, is a component of the [[Windows NT]] family of [[operating system]]s that provides the [[User space|user mode]] side of the [[Windows API|Win32 subsystem]] and is included in [[Windows NT 3.1]] andIn later.<refmodern name="GDI" /> Because mostversions of theWindows, Win32it subsystemis operationsprimarily haveinvolved beenwith movedprocess toand [[kernelthread mode]]management, [[DeviceWin32 driverconsole|drivers]]console in [[Windows NT 4window]] and laterhandling, CSRSS is mainly responsible for [[Win32side-by-side consoleassembly]] handlingloading and GUIthe shutdown. It is critical to system operation; therefore, terminating this [[Process (computing)|process]] will result in system failure. Under normal circumstancesOriginally, CSRSSit cannothad bealso terminatedbeen withresponsible thefor ''[[killrendering (command)#Microsoft_Windows_and_ReactOS|taskkill]]''graphics commandonscreen orand withimplementing [[Windowsthe Taskuser Manager]]interface, althoughhowever, itthese isoperations possiblehave inbeen [[Windowsmoved Vista]] if theto [[Taskkernel Manager (Windows)|Task Managermode]] isstarting run in Administrator mode. Onwith [[Windows 7]] and later, Task Manager will inform the user that terminating the process may result in system failure, and prompt if they want to continue. In Windows NT 4.0 however, terminating CSRSS without the [[Session Manager Subsystem]] (SMSS)to watchingimprove will not crash the systemperformance.<ref>{{YouTube|id=h1dBNTkL75A|t=0m31s|title=Winlogon.execite pt.II}}</ref> However, in [[Windows XP]], terminating CSRSS without SMSS watching will crash the system due to the critical bit being set in RAM for csrss.exe.web
== History ==
The [[Windows NT 3.x]] series of releases had placed the [[Graphics Device Interface]] component in CSRSS, but this was moved into kernel mode with Windows NT 4.0 to improve graphics performance.<ref name="GDI">{{cite web
|url=https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120
|title=The Windows NT 4.0 Kernel mode change
|work=MS Windows NT Kernel-mode User and GDI White Paper
|publisher=Microsoft
}}</ref> The Windows startup process from Vista onward has changed significantly. Two instances of csrss.exe are running in Windows 7 and Vista.<ref>{{cite web
CSRSS instances are marked as critical processes, meaning that terminating one will [[blue screen of death|crash]] the system. Built-in process management tools in most Windows versions will also refuse to kill instances of CSRSS. Under normal operation, there is a CSRSS instance for each session (two in [[Windows Vista]] and newer, one in earlier versions,<ref>{{cite web
|url=https://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx
|title=Inside the Windows Vista Kernel – Startup Processes
|work=Inside the Windows Vista Kernel – Startup Processes
|publisher=Microsoft
}}</ref> both assuming there are no active [[Remote Desktop Protocol|RDP]] connections which spawn extra sessions).
== Technical details ==
| 