The Windows Process Journey — csrss.exe (Client Server Runtime Subsystem)

The goal of “csrss.exe” (Client Server Runtime Subsystem) is to be the user-mode part of the Win32 subsystem (which is responsible for providing the Windows API). “csrss.exe” is included in Windows from Windows NT 3.1. It is located at “%windir%\\System32\\csrss.exe” (which is most of the time C:\\Windows\\System32\\csrss.exe).

From Windows NT 4.0 most of the Win32 subsystem has been moved to kernel mode — “With this new release, the Window Manager, GDI, and related graphics device drivers have been moved to …

client client server computerforensics csrss process runtime server subsystem windows