Appendix E. List of Default Processes

If you fire up Taskmgr or Process Viewer on any Windows 2000 or Windows Server 2003 system, you will see a core set of processes. These processes run by default on any system and handle things such as logons, managing certain services, and controlling the Windows shell. The complete list of these processes is in Table E-1.

Table E-1. Default Windows processes

Process name



An essential subsystem that is responsible for managing console windows, user-mode threads, and some parts of the 16-bit virtual MS-DOS environment. Csrss stands for client/server run-time subsystem.


Responsible for the user shell. If you’ve ever experienced the Start menu, taskbar, or Windows Explorer freezing up, terminating and restarting this process can help.


Responsible for authenticating users and issuing the access token associated with each user session.


Corresponds to the Task Scheduler service and is responsible for running scheduled tasks.


Service Control Manager (SCM), which is responsible for handling service management requests such as start, stop, and pause.


Session Manager, which is the first user-mode process to run after a system starts up. The kernel starts this process, which in turn, starts other user-mode processes, such as csrss.exe and winlogon.exe.


Responsible for spooling print and fax jobs.


Started by any service that is run from a dynamic link library. ...

Get Windows Server Cookbook now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.