# Client/Server Runtime Subsystem
> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Client%2FServer_Runtime_Subsystem
> Markdown URL: https://mediated.wiki/source/Client%2FServer_Runtime_Subsystem.md
> Source: https://en.wikipedia.org/wiki/Client%2FServer_Runtime_Subsystem
> Source revision: 1319612808
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)
{{Short description|Windows NT operating system component}}
The '''Client/Server Runtime Subsystem''', or csrss.exe, is a component of the [Windows NT](/source/Windows_NT) family of [operating system](/source/operating_system)s that provides the [user mode](/source/User_space) side of the [Win32 subsystem](/source/Windows_API). In modern versions of Windows, it is primarily involved with process and thread management, [console window](/source/Win32_console) handling, [side-by-side assembly](/source/side-by-side_assembly) loading and the shutdown process. Historically, it had also been responsible for window management and graphics rendering, however, these operations have been moved to [kernel mode](/source/kernel_mode) starting with [Windows NT 4.0](/source/Windows_NT_4.0) to improve performance.[{{cite web
|url=https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120
|title=The Windows NT 4.0 Kernel mode change
|access-date=2009-01-19
|work=MS Windows NT Kernel-mode User and GDI White Paper
|publisher=Microsoft
}}]
CSRSS instances are marked as critical processes, meaning that terminating one will [crash](/source/blue_screen_of_death) the system, if the critical status is removed and one is terminated, the system will freeze. Built-in process management tools in most Windows versions will also refuse to kill instances of CSRSS. Under normal operation, there is a CSRSS instance for each session (two in [Windows Vista](/source/Windows_Vista) and newer, one in earlier versions,[{{cite web
|url=https://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx
|title=Inside the Windows Vista Kernel – Startup Processes
|access-date=2010-10-01
|publisher=Microsoft
}}] both assuming there are no active [RDP](/source/Remote_Desktop_Protocol) connections which spawn extra sessions).
== Technical details ==
CSRSS runs as a user-mode [system service](/source/Windows_service). When a user-mode process calls a function involving console windows, process/thread creation, or [side-by-side](/source/Side-by-side_assembly) support, instead of issuing a [system call](/source/system_call), the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an [inter-process call](/source/Local_Procedure_Call) to the CSRSS process which does most of the actual work without compromising the kernel.[{{cite web
|url=http://www.left-brain.com/tabId/65/itemId/1642/pageId/29/Undocumented-Windows-NT.aspx
|title=Detailed implementation of a system service in Windows NT
|access-date=2010-06-10
|work=Undocumented Windows NT
|archive-url=https://web.archive.org/web/20110717032622/http://www.left-brain.com/tabId/65/itemId/1642/pageId/29/Undocumented-Windows-NT.aspx
|archive-date=2011-07-17
|url-status=dead
}}] Window manager and [GDI](/source/Graphics_Device_Interface) services are handled by a kernel mode driver (win32k.sys) instead.[{{cite book|last=Russinovich|first=Mark|authorlink=Mark Russinovich|title=Windows Internals, 5th Edition|year=2009|publisher=Microsoft Press|pages=54}}]
CSRSS is called along with winlogon.exe from [smss.exe](/source/Session_Manager_Subsystem) at Windows start-up. If either of the files is corrupted or otherwise inaccessible, SMSS will tell the kernel to shut down the start-up process with a [Blue screen of death](/source/Blue_screen_of_death).[{{Cite web|url=https://support.microsoft.com/en-us/help/156669/how-to-troubleshoot-a-stop-0xc000021a-error-in-windows-xp-or-windows-s|title=How to troubleshoot a "STOP 0xC000021A" error in Windows XP or Windows Server 2003|website=support.microsoft.com|access-date=2020-03-15}}] The error code for this fault is 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED).
In Windows 7 and later, instead of drawing console windows itself, CSRSS spawns conhost.exe subprocesses to draw console windows for command line programs with the permissions of that user.
== Malware hoaxes ==
There are numerous [virus hoax](/source/virus_hoax)es that claim that csrss.exe is [malware](/source/malware) and should be removed to prevent damage to the system; these are false, as removing csrss.exe or killing the csrss.exe [process](/source/Process_(computing)) will result in a system crash in Windows applications.
In addition, [technical support scam](/source/technical_support_scam)mers pretending to be Microsoft representatives are known to use csrss.exe as "proof" of a virus infection, and convince the user being scammed into purchasing their [rogue security software](/source/rogue_security_software) to remove it.[{{cite web|url=http://news.softpedia.com/news/symantec-disavows-business-partner-caught-running-a-tech-support-scam-499310.shtml|title=Symantec Disavows Business Partner Caught Running a Tech Support Scam|last=Cimpanu|first=Catalin|publisher=[Softpedia](/source/Softpedia)|date=Jan 22, 2016|access-date=July 29, 2016}}]
== See also ==
* [List of Microsoft Windows components](/source/List_of_Microsoft_Windows_components)
== References ==
{{Reflist}}
== External links ==
* [https://technet.microsoft.com/en-us/library/bb457123.aspx Troubleshooting the Startup Process (Windows XP Professional Resource Kit)]
{{Microsoft Windows components}}
{{DEFAULTSORT:Client Server Runtime Subsystem}}
Category:Windows NT architecture
---
Adapted from the Wikipedia article [Client/Server Runtime Subsystem](https://en.wikipedia.org/wiki/Client%2FServer_Runtime_Subsystem) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Client%2FServer_Runtime_Subsystem?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.