What is "csrss.exe"

What Is Client Server Runtime Process (csrss.exe), and Why Is It Running On My PC?

by Chris Hoffman

If you have a Windows PC, open your Task Manager and you’ll definitely see one or more Client Server Runtime Process (csrss.exe) processes running on your PC. This process is an essential part of Windows.

This article is part of our ongoing series explaining various processes found in Task Manager, like svchost.exe, dwm.exe, ctfmon.exe, mDNSResponder.exe, rundll32.exe, Adobe_Updater.exe, and many others. Don’t know what those services are? Better start reading!

What Is Client Server Runtime Process?

The csrss.exe process is an important part of the Windows operating system. Before Windows NT 4.0, which was released in 1996, csrss.exe was responsible for the entire graphical subsystem, including managing windows, drawing things on the screen, and other related operating system functions.

With Windows NT 4.0, many of these functions were moved from the Client Server Runtime Process, which runs as a normal process, to the Windows kernel. However, the csrss.exe process is still responsible for console windows and the shutdown process, which are critical functions in Windows.

Prior to Windows 7, the CSRSS process drew console (Command Prompt) windows itself. On Windows 7 and later, the Console Host (conhost.exe) process draws console windows. However, csrss.exe is still responsible for launching the conhost.exe process when necessary.

In other words, this process is responsible for a few critical system functions in the background. That’s just how Windows does things.

Can I Disable It?

You can’t disable this process, as it’s a crucial part of Windows. There’s no reason to disable it, anyway—it uses a tiny amount of resources and only performs a few critical system functions.

If you go into the Task Manager and try to end the Client Server Runtime Process, Windows will inform you that your PC will become unusable or shut down. Click through this warning and you’ll see an “Access is Denied” message. This is a protected process you can’t terminate.

Windows always launches this process at startup. If csrss.exe can’t be launched when Windows boots, Windows will blue screen with error code 0xC000021A. That’s how critical this process is.

Could It Be a Virus?

It’s normal for this process—or even multiple processes with this name—to always be running on Windows. The legitimate csrss.exe file is located in the C:\Windows\system32 directory on your system. To verify it’s the real Client Server Runtime Process, you can right-click it in Task Manager and select “Open file location”.

File Explorer or Windows Explorer should open to the C:\Windows\System32 directory containing the csrss.exe file.

If someone told you that the csrss.exe file located in C:\Windows\System32 is a virus, that’s a hoax. This is the real file and removing it will cause problems with your PC.

Tech support scammers have been known to say “if you see csrss.exe on your PC, you have malware”. Every PC has a Client Server Runtime Process running and that’s normal. Don’t fall for the scam!

If the csrss.exe file is in any other directory, you have a problem. Some malware programs disguise themselves as csrss.exe to avoid suspicion.

Whether you see a csrss.exe file in the wrong folder or you’re just concerned you might have malware in general, you should run a system scan with your preferred antivirus tool. It will check your PC for malware and remove anything it finds
.