Section 8: Session Manager and Services

The Big Picture: Hiring the Staff

The kernel is running and can use memory, files and drivers. But the kernel is only the engine. There is no sign-in screen, no background helpers and no network yet. These all come from user-mode programs: ordinary programs that run in the safe area away from the kernel (Section 1.2).

The kernel starts one such program, smss.exe (the Session Manager), and that program starts the next ones. It is a chain of starters:

Kernel ─► smss.exe ─► wininit.exe ─► services.exe  (the Service Control Manager)
             │                  └──► lsass.exe     (security and sign-in checking)
             │
             └────► winlogon.exe ─► LogonUI.exe     (the sign-in screen, Section 9)

(csrss.exe, the Windows subsystem process, is started alongside each of these. It supports the basic Windows functions that programs rely on.)

Most of what you read here happens in the background while you watch the Windows logo.

8.1 Session Manager (smss.exe)

What it is: smss.exe is the Session Manager Subsystem. It is the first user-mode process and is started directly by the kernel. If smss.exe cannot start or stops, Windows cannot continue and shows a blue screen (the stop code is CRITICAL_PROCESS_DIED or similar).

What is a session? A session is a separate "workspace" of processes, windows and settings. Windows has two kinds:

Since Windows Vista, services are kept in Session 0, away from the user's desktop. This is session 0 isolation, a safety measure: a background service can no longer show windows on your desktop, and a program you run cannot easily attack a service's windows.

What smss.exe does:

1. Runs the tasks listed in the registry's BootExecute value. The classic one is autochk, which checks a disk for errors if Windows marked it "dirty" (this is the "Checking file system" screen).
2. Creates the paging file(s), such as pagefile.sys, which the memory manager uses (Section 7.2).
3. Finishes loading the registry hives (Section 7.6) and sets environment variables (like PATH).
4. Starts the Windows subsystem: it launches csrss.exe (the Client/Server Runtime Subsystem).
5. Creates session 0 and starts wininit.exe in it.
6. Creates session 1 and starts winlogon.exe in it (Section 9).
7. After that, it waits and creates further sessions whenever another user signs in.

smss.exe uses child copies of itself for each new session. The copy builds the session, then ends, leaving csrss.exe and winlogon.exe behind.

See it: In Task Manager → Details, you will see smss.exe, one or more csrss.exe, wininit.exe and winlogon.exe. These are normal and always run. Their absence, or duplicates in odd places, may suggest malware.

8.2 Services Start (services.exe)

What it is: A service is a program that runs in the background without a window. Services do jobs like: connect to Wi-Fi, print, update Windows, search files, or protect against viruses. They start automatically, so the PC is ready even before you sign in.

The program that starts services is services.exe. wininit.exe launches it in session 0. At the same time, wininit.exe starts two other key processes:

Many services share one process. Windows has hundreds of services. To save memory, many of them run together inside a single helper program called svchost.exe (Service Host). That is why Task Manager shows many svchost.exe entries. Each one carries a group of services.

How to see your services (no admin needed to look):

Get-Service | Sort-Object Status | Select-Object -First 20

Or press Win + R, type services.msc and press Enter, to open the Services window.

8.3 Service Control Manager (SCM)

What it is: The Service Control Manager (SCM) is the part of services.exe that decides which services start, when and in what order. It is the shift supervisor of the staff.

Each service has a Startup type (the same numbers as drivers in Section 6.2):

The SCM's routine:

1. Reads the list of services from HKLM\SYSTEM\CurrentControlSet\Services in the registry.
2. Sorts them by load order group and by dependencies. A dependency means "service B needs service A to be running first". For example, a network sharing service depends on the network stack.
3. Starts every Automatic service in the right order. Services without dependencies on each other can start at the same time, which speeds boot.
4. Later, starts the Delayed services.
5. Watches them. If a service crashes, the SCM can follow its recovery settings (for example, "restart the service").

Why do some services fail? A service may fail because a dependency did not start, because its file is damaged, or because its account has the wrong password. Windows writes these problems to the System log in Event Viewer. Some useful event numbers: 7000 and 7001 (a service failed to start, or a dependency failed), 7026 (a boot or system-start driver failed to load), and 7034 (a service ended without warning). Section 11.6 uses them.

Be careful: Do not disable services you do not understand. Windows depends on many of them even if their names look odd.

8.4 Device Enumeration and Initialization

What it is: In Section 7.4 the kernel built the device tree for devices that were present at boot. Now, with services running, more devices come to life: things that need a service or a user-mode part to work.

This is the Plug and Play work of user mode:

• The Plug and Play service (PlugPlay) takes part in installing drivers for new devices. When you plug in a USB stick, the PnP manager notices it, finds a driver and starts it.
• The Device Install service handles driver packages from Driver Store, a protected folder where Windows keeps approved drivers.
• Some hardware has user-mode parts, such as the audio service (Audiosrv), the Bluetooth service, and the print spooler (Spooler), a service that manages print jobs.
• Graphics. A fuller graphics driver loads (if the boot logo used a basic one), so the screen moves to the right resolution. (You may see the screen blink briefly. It is normal.)
• Storage. Extra disks and volumes are mounted and get drive letters (D:, E:...). Removable drives appear.
• Input. Keyboard, mouse, touchpad and touchscreen drivers finish setting up.

This work continues even after you reach the desktop. That is why, when you plug in a new gadget, Windows says "Setting up a device..." at that moment.

See it: pnputil /enum-devices /connected (administrator Command Prompt) lists the devices currently present.

8.5 Network Stack Initialization

What it is: The network stack is the layered set of drivers and services that lets the PC talk on a network. You should have a working network before you need it, such as for domain sign-in or for cloud apps that start with Windows.

Here is the order, from the bottom up:

The PC may get an IP address within a second or two of the link coming up, or within several seconds for Wi-Fi, because Wi-Fi must join the network first. Some programs wait for this and may show "no connection" for a short time after you sign in.

Cable or Wi-Fi up ─► NDIS ─► TCP/IP ─► DHCP gets an address ─► DNS works ─► NLA sets network type ─► apps go online

Try this (PowerShell): Get-NetIPConfiguration shows your adapter, IP address and gateway. ipconfig /all shows the same in Command Prompt.

After this, the PC is a full network citizen. The next step turns attention to the person: you (Section 9).

Summary