Section 5: System Processes

The Big Picture: Who Starts Whom

When Windows boots, the kernel starts one user-mode program, and that program starts the next, which starts the next. By the time you see your desktop, a whole family tree of system processes is running. Knowing the "family" helps you read Task Manager and spot fakes.

System (PID 4)  ← kernel-mode worker, no .exe file
   │
   └─ smss.exe  (Session Manager)  ← first real user-mode program
        ├─ csrss.exe      (session 0)
        ├─ wininit.exe    (session 0)
        │     ├─ services.exe  (Service Control Manager)
        │     │     └─ svchost.exe ... (many)
        │     └─ lsass.exe     (security)
        │
        ├─ csrss.exe      (session 1)
        └─ winlogon.exe   (session 1)
              └─ (after logon) userinit.exe → explorer.exe  (your desktop)

(The parents are slightly hidden in practice: smss.exe starts these and then some of the starter processes exit. Tools like Process Explorer may show some of them without a visible parent. That is normal.)

5.1 System (Kernel)

What it is: The process named System has PID 4. It is not a normal program. There is no System.exe file on disk. It is the home for kernel-mode threads: the OS's own worker threads that run drivers and Executive code.

Why a process at all? In NT every thread must belong to a process. Threads that run kernel code need a "home". That home is the System process.

What it does:

• Runs kernel worker threads for things like deferred work, disk writes and driver tasks.
• Owns many kernel handles (Section 6).
• Is the parent of smss.exe (the first user-mode program).

What you may see. Task Manager also shows System Idle Process (PID 0), which is not really a process: it simply stands for "CPU time nobody used". A high number there is good news: it means the CPU is idle. You may also see Registry and Memory Compression, which are special minimal processes used by the Configuration Manager and Memory Manager in recent Windows versions.

Windows tip: If "System" uses a lot of CPU or disk, it usually means a driver or the kernel is busy (for example, disk indexing or antivirus filters). It is rarely a virus on its own.

5.2 Smss.exe (Session Manager)

What it is: smss.exe (Session Manager Subsystem) is the first user-mode process created by the kernel. It is the "foreman" that sets up the work areas (sessions).

What it does at boot:

1. Reads its settings from the registry (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager).
2. Creates the page file settings and some environment variables.
3. Starts session 0: launches csrss.exe and wininit.exe there.
4. Starts session 1 for the first user: launches another csrss.exe and winlogon.exe.
5. Stays alive to create a new session every time another user logs on (fast user switching, Remote Desktop).

A critical process. If smss.exe stops, Windows crashes. It is one of the processes the system cannot live without.

Boot-time chores. On boot it can also run programs listed under BootExecute in the registry. The best known is autochk, a disk check that can run before Windows fully starts.

5.3 Services.exe (Service Control Manager)

What it is: services.exe is the Service Control Manager (SCM). It is started by wininit.exe in session 0. The SCM is the boss of all services.

What it does:

• At boot, reads the list of services from HKLM\SYSTEM\CurrentControlSet\Services (the registry again).
• Starts every service marked Automatic, in the right order (a service can depend on another).
• Starts svchost.exe processes to host service DLLs (Section 4.3).
• Handles start, stop, pause requests. When you use the Services window (services.msc) or Get-Service, you are talking to the SCM.
• Restarts a service if it fails, when set up to do so.

Start types:

Windows tip: Run Get-Service | Sort-Object Status | Select-Object -First 15 Name, Status, StartType. The SCM is also the reason the Services list shows the "Log On As" account: it decides which rights each service has.

5.4 Lsass.exe (Local Security Authority)

What it is: lsass.exe (Local Security Authority Subsystem Service) is the process that checks who you are. When you type a password, lsass.exe verifies it.

Its jobs:

Remember the split from Section 3.4: lsass says "this person is Anna" (user mode); the SRM later checks "may Anna open this file?" (kernel mode).

Why attackers love it. Because lsass.exe handles logon secrets, attackers try to copy its memory to steal credentials. Windows protects it with features such as LSA Protection and Credential Guard (Part 10 and Part 33 cover this).

Critical process. If lsass.exe ends, Windows forces a shutdown.

5.5 Csrss.exe (Client/Server Runtime)

What it is: Section 4.2 already introduced csrss.exe. Here is how it fits in the family tree.

• smss.exe starts one csrss.exe per session.
• It lives in C:\Windows\System32 and runs as SYSTEM.
• It cooperates with win32k*.sys and conhost.exe.
• It is a critical process: if it ends, Windows crashes.

Because csrss.exe has no visible parent in some tools, do not worry: its parent (smss.exe) has already finished the setup work and exited.

5.6 Svchost.exe (Service Host)

What it is: Section 4.3 told you what svchost.exe is. Here are the family rules that help you tell the real one from a fake:

If you see an svchost.exe in another folder, started by a normal program, or with no -k, be suspicious.

What to do when one uses a lot of CPU. Open Task Manager's Services tab (or tasklist /svc) and find which service lives inside it. Then fix or stop that service, not the host.

5.7 Wininit.exe (Windows Initialization)

What it is: wininit.exe (Windows Start-Up Application) is started by smss.exe in session 0. It finishes the setup of the system side of Windows.

What it does:

• Starts services.exe (the SCM) and lsass.exe.
• Sets up some temporary system folders.
• Is also involved in the shutdown sequence for the system side.

Where it stands in the tree. wininit.exe is the session 0 counterpart of winlogon.exe. One prepares the system, the other prepares the user.

5.8 Winlogon.exe (User Logon)

What it is: winlogon.exe (Windows Logon Application) is started by smss.exe in each user session. It is the doorman: it handles everything between the lock screen and the desktop.

What it does:

1. Waits for the Secure Attention Sequence: pressing Ctrl + Alt + Delete (a key combination that normal programs cannot fake).
2. Starts LogonUI, the screen where you type your password or PIN.
3. Sends your credentials to lsass.exe for checking.
4. After a good logon, loads your user profile: it loads your registry file NTUSER.DAT (Section 7.2) and sets up your environment.
5. Starts userinit.exe, which runs logon scripts and then launches your shell, explorer.exe.
6. Handles lock, log off and shutdown requests.

Why Ctrl + Alt + Delete? Only winlogon.exe can see this key combination. So when you press it, you know the next screen is the real Windows, not a fake one a program drew.

5.9 Explorer.exe (Shell)

What it is: explorer.exe is the shell: the part of Windows you actually see and use. The word shell means "the outer layer you interact with" (not to be confused with the command shell). Explorer draws the desktop, taskbar, Start menu and the File Explorer windows.

How it starts. winlogon.exe runs userinit.exe, which starts explorer.exe. Then userinit.exe exits. That is why Explorer has no visible parent.

What it does:

• Shows files and folders in File Explorer.
• Starts programs when you double-click or use the Start menu.
• Hosts the notification area (system tray) and Quick Settings.
• Starts items from the user's Run registry keys and startup folder.

A normal program. Unlike the others in this section, Explorer is not critical. It runs as you, in ring 3, in your session. If it crashes, the taskbar vanishes, but Windows keeps running. You can restart it: Task Manager → find Windows Explorer → Restart, or run explorer.exe from Win + R after ending it.

Summary