csrss.exe C:\Windows\System32\csrss.exe

Client/Server Runtime Subsystem: user-mode part of the Windows subsystem (processes, threads, shutdown). Critical process, never terminate it.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

csrss.exe (Client/Server Runtime Subsystem) is the user-mode part of the Win32 subsystem. It takes part in creating and ending processes and threads, and in system shutdown. One instance runs in each session. Since Windows 7, console windows no longer go through it but through conhost.exe.

Never terminate it: it is a critical process, and stopping it causes a blue screen.

What it contains

An executable signed by Microsoft in C:\Windows\System32.
Several processes at once: at least one instance in session 0 (services) and one per interactive session.
Subsystem libraries loaded in memory, such as csrsrv.dll, basesrv.dll and winsrv.dll.

Risks and best practices

The genuine csrss.exe is signed, lives in System32 and has a short-lived smss.exe as parent that has already exited. An instance started from another folder or by an ordinary user is suspicious: this name is a classic malware disguise.
Never replace the file with another one, even “of the same version”.

Useful commands

# Running instances: one per session (0 and at least one interactive); run as administrator to see the path
Get-Process -Name csrss -IncludeUserName -ErrorAction SilentlyContinue | Select-Object Id, SessionId, UserName, StartTime, Path

# Digital signature of the file
Get-AuthenticodeSignature "$env:windir\System32\csrss.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

Report a mistake