TheSession Manager Subsystem, orsmss.exe, is a component of theMicrosoftWindows NT family ofoperating systems, starting inWindows NT 3.1. It is executed during thestartup process of those operating systems.
The Session Manager Subsystem is the first user-mode process started by the kernel. Once started it creates additional paging files with configuration data fromHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management,[1] the environment variables located at the registry entryHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment, andDOS device mappings (e.g.CON:,NUL:,AUX:,COM1:,COM2:,COM3:,COM4:,PRN:,LPT1:,LPT2:,LPT3:, and drive letters) listed at theHKLM\System\CurrentControlSet\Control\Session Manager\DOS Devices registry key. This can be used to create permanentsubst drives.
The manager is responsible for starting thekernel and user modes of theWin32 subsystem. This subsystem includeswin32k.sys (kernel-mode),winsrv.dll (user-mode), andcsrss.exe (user-mode).[2] Any other subsystems listed in theRequired value of theHKLM\System\CurrentControlSet\Control\Session Manager\SubSystemsRegistry key are also started.
The manager is also responsible for doing any operations that are requested to be done at the start of a session. Commands listed inHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute, such asautochk andconvert, are executed. These commands are run before services are loaded by later steps of the booting process.[3] Any rename operations queued atHKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations. This is used to allow previously in-use files (e.g. drivers) to be replaced as part of a reboot.[4]
Starting with Windows Vista, the Session Manager Subsystem creates a temporary instance of itself that launches the Windows Startup Application (wininit.exe) and a second Client/Server Runtime Subsystem (csrss.exe) for Session 0, a session dedicated to system processes. From here, the Windows Startup Application starts theService Control Manager (services.exe), which starts all the Windows services that are set to "Auto-Start".[4] The application also starts theLocal Security Authority Subsystem Service (lsass.exe). Before Windows Vista, these processes where started byWindows Logon instead of the Windows Startup Application.[5]
Once the session is configured, the Session Manager Subsystem startsWinlogon (Windows Logon Application), which is responsible for handling interactive logons to a Windows system, either local or remote.[5]
After the boot process is finished, the program resides in memory and can be seen running in theWindows Task Manager. It then waits for eitherwinlogon.exe orcsrss.exe to end, at which point Windows will shut down. If the processes do not end in an expected fashion,smss.exe may hang the system, or abugcheck will occur.[6] It also initiates new user sessions when needed.In some versions of Windows, by using special tools, the critical process status onsmss.exe can be removed, after that, it can be terminated without a bluescreen, but any functions that usesmss.exe stop working until the next reboot.[citation needed]
The Local Session Manager Service (lsm.exe) sends requests to SMSS through theAsynchronous Local Inter-Process Communication (ALPC) portSmSsWinStationApiPort to start new sessions.
Each time a user logs onto the system, the initial Session Manager creates a new instance of itself to configure a new session. This new process starts a Win32 subsystem and Winlogon process for the new session. This allows for multiple users to logon at the same time onWindows Server systems.[5]
init — a similar process in Unix-style systems
