Windows Server Cookbook

Appendix E. List of Default Processes

If you fire up Taskmgr or Process Viewer on any Windows 2000 or Windows Server 2003 system, you will see a core set of processes. These processes run by default on any system and handle things such as logons, managing certain services, and controlling the Windows shell. The complete list of these processes is in Table E-1.

Table E-1. Default Windows processes

Process name	Purpose
Csrss.exe	An essential subsystem that is responsible for managing console windows, user-mode threads, and some parts of the 16-bit virtual MS-DOS environment. Csrss stands for client/server run-time subsystem.
Explorer.exe	Responsible for the user shell. If you’ve ever experienced the Start menu, taskbar, or Windows Explorer freezing up, terminating and restarting this process can help.
Lsass.exe	Responsible for authenticating users and issuing the access token associated with each user session.
Mstask.exe	Corresponds to the Task Scheduler service and is responsible for running scheduled tasks.
Services.exe	Service Control Manager (SCM), which is responsible for handling service management requests such as start, stop, and pause.
Smss.exe	Session Manager, which is the first user-mode process to run after a system starts up. The kernel starts this process, which in turn, starts other user-mode processes, such as csrss.exe and winlogon.exe.
Spoolsv.exe	Responsible for spooling print and fax jobs.
Svchost.exe	Started by any service that is run from a dynamic link library. ...