List of common Windows System Processes

I. Basic System Processes

That is to say, these processes are the basic conditions for the system to run normally.

1,Smss.exeSession Manager

2,Csrss.exeSubsystem server process

3,Winlogon.exeManage user logon

4,Services.exeIncluding many system services

5,Lsass.exeManage IP Security Policies and start ISAKMP/Oakley (IKE) and IP Security drivers. (System Service) generate session keys and grant service creden for Interactive Client/Server Verification

6. ticket. (System Service)-> netlogon

7,Svchost.exeContains many system services !!! -> Eventsystem

8,SPOOLSV. EXELoad the file into the memory so that it is not necessary to print the file without a printer later ).

9,Assumer.exeResource Manager

10,Internat.exeThe patch map of the Disk Area, with officexpand ctfmon.exe installed.

2. Additional System Processes

These processes are not necessary. You can use the service manager to increase or decrease the number of processes as needed.

1,Mstask.exeAllows programs to run at a specified time. (System Service)-> schedule

2,Regsvc.exeAllow Remote Registry operations. (System Service)-> remoteregister 3,Winmgmt.exeProvides system management information (system services ).

4,Inetinfo.exe-> Msftpsvc, w3svc, iisadmn

5,Tlntsvr.exe-> Tlnrsvr

6,Tftpd.exeImplement the TFTP Internet standard. This standard does not require the user name and password and is part of the Remote Installation service. (System Service)

7,Termsrv.exeThe multi-session environment allows client devices to access virtual Windows 2000 Professional desktop sessions and Windows-based programs running on servers. (System Service)

8,Dns.exeResponds to query and update requests for Domain Name System (DNS) names. (System Service)

Iii. system servicesAnd is rarely used. If you do not need it for the moment, you should turn it off (which is harmful to security)

1,Tcpsvcs.exeProvides the ability to remotely install Windows 2000 Professional on PXE. (System Service)-> simptcp supports the following TCP/IP Services: Character Generator, Daytime, Discard, Echo, and Quote of the Day. (System Service)

2,Ismserv.exeAllows you to send and receive messages between Windows Advanced Server sites. (System Service)

3,Ups.exeManages the uninterruptible power supply (UPS) that is connected to the computer ). (System Service)

4,Wins.exeProvide NetBIOS Name Service for TCP/IP customers who register and resolve NetBIOS names. (System Service)

5,Llssrv.exeLicense Logging Service (system service) 6,Ntfrs.exeMaintain file synchronization between multiple servers in the file directory. (System Service)

7,RsSub.exeControls the media used to remotely store data. (System Service)

8,Locator.exeManage the RPC Name Service database. (rpclocator RpcSs)

9,Lserver.exeRegister the client license. (System Service)

10,Dfssvc.exeManage logical volumes distributed on the LAN or WAN. (System Service)

11,Clipsrv.exeSupports the "Clipboard viewer" to view the clipboard page from a remote clipboard. (System Service)

12,Msdtc.exeParallel transactions are distributed in more than two databases, message queues, file systems, or other transaction protection resource managers. (System Service)

13,Faxsvc.exeHelp you send and receive faxes. (System Service)

14,Cisvc.exeIndexing Service (system service )!!!

15,Dmadmin.exeSystem Management Service for disk management requests. (System Service)

16,Mnmsrvc.exeAllow authorized users to remotely access Windows desktops using NetMeeting. (System Service)

17,Netdde.exeProvides Dynamic Data Exchange (DDE) network transmission and security features. (System Service)

18,Smlogsvc.exeConfigure Performance Logs and alarms. (System Service)

19,Rsvp.exeProvides network signal and local communication control installation for quality service (QoS)-dependent programs and control applications. (System Service)

20,RsEng.exeCoordinates the service and management tools used to store infrequently used data. (System Service)

21,RsFsa.exeManage objects stored remotely. (System Service)

22,Grovel.exeScan duplicate files on the Zero backup storage (SIS) volume and point the duplicate files to a data storage point to save disk space. (System Service)

23,SCardSvr.exeManage and control the smart cards inserted into the computer smart card reader. (System Service) 24,Snmp.exeThe agent can monitor the activities of network devices and report to the Network Console workstation. (System Service)

25,Snmptrap.exeReceives trap messages generated by local or remote SNMP agents, and then transmits the messages to the SNMP manager running on this computer. (System Service)

26,UtilMan.exeEnable and configure auxiliary tools from a window. (System Service)

27,Msiexec.exeInstall, fix, and delete software based on the commands in the. MSI file. (System Service)

Other supplements:

Sfmprint.exe> Print Services for Macintosh printing Macintosh Service

Nspmon.exeWindows Media Monitor Service (NsMonitor)

Nsum.exeWindows Media Unicast Service (NsUnicast) Microsoft document: Default process in Windows 2000

Csrss.exe-You cannot end the process from the task manager.

User Mode of the Win32 subsystem. Win32.sys is the kernel mode ). Csrss representativeClient/server run-time subsystemClient/Server Runtime subsystem), which is a basic subsystem and must always run. Csrss manages console windows, creates and/or deletes threads, and is responsible for some parts of a 16-bit virtual MS-DOS environment.

Assumer.exe-You can end the process from the task manager. This is the user shell program, that is, the taskbar and desktop that we are familiar. This process does not play a role in the normal operation of Windows as we think, and can be stopped and restarted from the Task Manager), and usually does not bring any side effects to the system.

Internat.exe-You can end the process from the task manager. Internat.exe runs at startup. It loads different input method settings specified by the user. Set the registry key HKEY_CURRENT_USERKeyboard LayoutPreload Internat.exe to load the "EN" icon to the taskbar, which allows you to easily switch between region settings. When the process stops, this icon disappears, but you can still change the region settings through the control panel.

Note:: "System" region settings are loaded from the following locations: HKEY_USERS.DEFAULTKeyboard LayoutPreload these regions are set to be used by system services running under the "local system" account, or when no user is logged on, for example, when a logon prompt is displayed) UseLsass.exe-You cannot end the process from the task manager.

The Local Security Authentication Server generates a process that authenticates the user's identity to use the Winlogon service. This process is executed by using the authentication package, such as the default Msgina. dll. If the authentication succeeds, Lsass generates the user's access token, which is used to start the initial shell program. Other processes started by the user will inherit this token.

Mstask.exe-You cannot end the process from the task manager. The scheduler service is responsible for running tasks at the user's specified time.Smss.exe-You cannot end the process from the task manager. This is the session manager subsystem that starts user sessions. This process is started by the system thread and is responsible for various activities, including starting Winlogon and Win32 (Csrss.exe) processes and setting system variables. When it starts these processes, it will wait until Winlogon or Csrss ends. If these processes are "normal", the system will shut down. If the process is abnormal, smss.exe will cause the system to stop responding ).

Spoolsv.exe-You cannot end the process from the task manager. The background printer service is responsible for managing the print/fax tasks sent to the background.

Svchost.exe-You cannot end the process from the task manager. This is a common process that acts as the host of other processes running from the DLL; therefore, this process should have multiple projects, which is normal. Which of the following processes is using svchost.exe? Use tlist.exe in Windows 2000 to install the optical drive. The syntax is to enter

Tlist-s Services.exe-You cannot end the process from the task manager. The Service Control Manager is responsible for starting and stopping system services and interacting with system services.

System-You cannot end the process from the task manager. Most threads in the system kernel mode run as system processes.

System Idle Process-You cannot end the process from the task manager. This process is a single thread running on each processor. Its only task is to occupy the processor time when the system does not process other threads. In Task Manager, this process takes up most of the processor time.Taskmgr.exe-You can end the process from the task manager. This is the process of the task manager.

Winlogon.exe-You cannot end the process from the task manager. This process manages user logon and logout. In addition, Winlogon is activated only when you press Ctrl + Alt + Del. A security dialog box is displayed.

Winmgmt.exe-You cannot end the process from the task manager.

Winmgmt.exe is the core component of Client Management in Windows 2000. When the first client application is connected, the process will be initialized, or when the management application requests services of the process, this process will constantly initialize many processes that cannot end from the task manager. You can use the resource toolbox utility.Kill.exe. However, this command may cause system faults or other undesirable side effects.