PROCESSMicrosoft-signedCritical process
csrss.exeClient Server Runtime Subsystem
csrss.exe (Client Server Runtime Subsystem) is an essential Windows process that manages console windows, the creation and deletion of threads and processes, and part of the shutdown sequence. Two instances are normal (one per session). It cannot be ended without crashing Windows, and the genuine file is in System32, signed by Microsoft.
What csrss.exe does
The Client Server Runtime Subsystem is one of the user-mode components that Windows cannot start without. Historically it provided much of the Win32 environment; today its main responsibilities are managing console (command-prompt) windows, handling the creation and termination of threads and processes on behalf of the kernel, and participating in the shutdown sequence. Console window hosting itself was moved to conhost.exe in Windows 7, but csrss still coordinates it.
Why two instances are normal
Windows starts one csrss.exe for session 0 (where services run) and one for the interactive user session. Each additional interactive session, for example with fast user switching, adds one. Two on a single-user PC is expected.
Why it cannot be ended
csrss.exe is a critical process. The kernel monitors it; if it exits unexpectedly, Windows bug-checks (often critical process died) or shuts down. Task Manager blocks attempts to end it. There is no legitimate reason to terminate it.
Confirming it is genuine
- Path:
C:\Windows\System32\csrss.exeonly. - Signature: Microsoft.
- Count: typically two; investigate more, or any copy outside System32.
- Spelling: watch for
csrsss.exe,cssrss.exeand similar imposters.
Because malware knows csrss.exe cannot be ended and looks alarming, using the name is a common disguise. The path and signature are the reliable test.
Frequently asked questions
Why are there two csrss.exe processes?
One runs for the core session (session 0, services) and another for the interactive user session. More than two, or one running from outside System32, is worth investigating. Fast user switching can add one per logged-on session.
Can I end csrss.exe?
No. Windows protects it, and ending it forces a shutdown. Task Manager refuses with "This is a critical system process."
Is csrss.exe malware?
The real process is signed by Microsoft and located in C:\Windows\System32. Malware has impersonated the name from other folders or with variants like csrsss.exe. Check the path and signature.