'''Client Server Runtime Subsystem''', or <ttcode>csrss.exe</ttcode>, is a component of the [[Windows NT]] family of [[operating system]]s that provides the [[User space|user mode]] side of the [[Windows API|Win32 subsystem]] and is included in [[Windows NT 3.1]] and later.<ref name="GDI" /> Because most of the Win32 subsystem operations have been moved to [[kernel mode]] [[Device driver|drivers]] in [[Windows NT 4]] and later, CSRSS is mainly responsible for [[Win32 console]] handling and GUI shutdown. It is critical to system operation; therefore, terminating this [[Process (computing)|process]] will result in system failure. Under normal circumstances, CSRSS cannot be terminated with the ''[[kill (command)|taskkill]]'' command or with [[Windows Task Manager]], although it is possible in [[Windows Vista]] if the Task Manager is run in Administrator mode. On [[Windows 7]] and later, Task Manager will inform the user that terminating the process may result in system failure, and prompt if they want to continue. In Windows NT 4.0 however, killing csrss without smss watching will not crash the system. However in Windows XP, killing csrss without smss watching will crash the system due to the critical bit being set in RAM for csrss.exe
== History ==
Line 27:
}}</ref> Window manager and [[Graphics Device Interface|GDI]] services are handled by a kernel mode driver (win32k.sys) instead.<ref>{{cite book|last=Russinovich|first=Mark|title=Windows Internals, 5th Edition|year=2009|publisher=Microsoft Press|pages=54}}</ref>
CSRSS is called along with <ttcode>winlogon.exe</ttcode> from [[Session Manager Subsystem|smss.exe]] at Windows start-up. If either of the files is corrupted or otherwise inaccessible, SMSS will tell the kernel to shut down the start-up process with a [[Blue Screen of Death]].<ref>{{Cite web|url=https://support.microsoft.com/en-us/help/156669/how-to-troubleshoot-a-stop-0xc000021a-error-in-windows-xp-or-windows-s|title=How to troubleshoot a "STOP 0xC000021A" error in Windows XP or Windows Server 2003|last=|first=|date=|website=support.microsoft.com|url-status=live|archive-url=|archive-date=|access-date=2020-03-15}}</ref> The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).
In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns <ttcode>conhost.exe</ttcode> subprocesses to draw console windows for command line programs with the permissions of that user.