Client/Server Runtime Subsystem: Difference between revisions

Revision as of 06:55, 15 March 2020

Revision as of 21:22, 15 March 2020

Line 27:

}}</ref> Window manager and [[Graphics Device Interface|GDI]] services are handled by a kernel mode driver (win32k.sys) instead.<ref>{{cite book|last=Russinovich|first=Mark|title=Windows Internals, 5th Edition|year=2009|publisher=Microsoft Press|pages=54}}</ref>

CSRSS is called along with <tt>winlogon.exe</tt> from [[Session Manager Subsystem|smss.exe]] at Windows start-up. If either of the files is corrupted or otherwise inaccessible, the NT kernel will shut down the start-up process with a [[Blue Screen of Death]]. This is caused by a kernel-mode process responsible for calling these files intentionally stopping the system.<ref>{{Cite web|url=https://support.microsoft.com/en-us/help/156669/how-to-troubleshoot-a-stop-0xc000021a-error-in-windows-xp-or-windows-s|title=How to troubleshoot a "STOP 0xC000021A" error in Windows XP or Windows Server 2003|last=|first=|date=|website=support.microsoft.com|url-status=live|archive-url=|archive-date=|access-date=2020-03-15}}</ref> The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).

In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns <tt>conhost.exe</tt> subprocesses to draw console windows for command line programs with the permissions of that user.