TheClient/Server Runtime Subsystem, orcsrss.exe, is a component of theWindows NT family ofoperating systems that provides theuser mode side of theWin32 subsystem. In modern versions of Windows, it is primarily involved with process and thread management,console window handling,side-by-side assembly loading and the shutdown process. Historically, it had also been responsible for window management and graphics rendering, however, these operations have been moved tokernel mode starting withWindows NT 4.0 to improve performance.[1]
CSRSS instances are marked as critical processes, meaning that terminating one willcrash the system. Built-in process management tools in most Windows versions will also refuse to kill instances of CSRSS. Under normal operation, there is a CSRSS instance for each session (two inWindows Vista and newer, one in earlier versions,[2] both assuming there are no activeRDP connections which spawn extra sessions).
CSRSS runs as a user-modesystem service. When a user-mode process calls a function involving console windows, process/thread creation, orside-by-side support, instead of issuing asystem call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send aninter-process call to the CSRSS process which does most of the actual work without compromising the kernel.[3] Window manager andGDI services are handled by a kernel mode driver (win32k.sys) instead.[4]
CSRSS is called along withwinlogon.exe fromsmss.exe at Windows start-up. If either of the files is corrupted or otherwise inaccessible, SMSS will tell the kernel to shut down the start-up process with aBlue screen of death.[5] The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).
In Windows 7 and later, instead of drawing console windows itself, CSRSS spawnsconhost.exe subprocesses to draw console windows for command line programs with the permissions of that user.
There are numerousvirus hoaxes that claim that csrss.exe ismalware and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exeprocess will result in a system crash in Windows applications.
In addition,technical support scammers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing theirrogue security software to remove it.[6]
