Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. smss.exe
FileRisk: Do not touch

smss.exe C:\Windows\System32\smss.exe

smss.exe: the Session Manager Subsystem, the first user-mode process. It creates sessions and starts csrss, wininit and winlogon.

Updated on By AltF4 Formation

What it’s for

smss.exe is the first user-mode process the kernel starts. It reads HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, prepares the environment (paging file, environment variables, pending file renames), then creates the sessions. In them it launches csrss.exe and wininit.exe (session 0) or winlogon.exe (interactive sessions).

What it contains

  • An executable signed by Microsoft in C:\Windows\System32.
  • A persistent master instance, and short-lived instances that exit once the session is created.
  • Deferred file operations (PendingFileRenameOperations), often tied to updates, which smss.exe carries out at boot.

Risks and best practices

  • Do not terminate it: it is a critical process, and ending it causes a blue screen (code 0xC000021A).
  • Malware likes to imitate this name. The real smss.exe is in System32, signed, and its parent is the System process.
  • Leave BootExecute (autocheck autochk * by default) and the other Session Manager values alone unless you follow a documented procedure.

Useful commands

Fenêtre de terminal
# Inspect the process (path, session, parent): run as administrator to see the path
Get-CimInstance Win32_Process -Filter "Name='smss.exe'" | Select-Object ProcessId, ParentProcessId, SessionId, ExecutablePath


# Check the file's digital signature
Get-AuthenticodeSignature "$env:windir\System32\smss.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}


# Read the commands run very early at boot (BootExecute) and pending renames
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' | Select-Object BootExecute, PendingFileRenameOperations

Report a mistake