Windows system processes

System Idle Process (idle)

The process has an ID of 0, where each processor or check should have a thread.

System process

In Windows XP and Windows Server 2003, the process ID 4, which contains the kernel-mode system process. The system worker threads, as well as the threads created by the execution body and the driver through Pscreatesystemthread, are in the systems process.

Conversation Manager (Session manager, Smss.exe)

This is the first user-mode process created in the Windows system. SMSS takes some important steps during Windows startup, such as creating environment variables, and, most importantly, it initiates the subsystem process Csrss.exe and the login process Winlogon.exe. In addition, the session manager is responsible for creating new Terminal Server sessions (Terminal Server session), including establishing the mathematical structure of the session space, and then loading the subsystem for the new Terminal Server session, starting the Csrss.exe and logging process Winlogon.exe.

Logon process (Winlogon.exe)

It handles logon and logoff for interactive users. When the user presses the Ctrl+alt+del key combination (known as the security Note sequence [SAS, secure Attention Sequence]), Winlogon receives a logon request, then fires the secure authentication process and initiates the initial process in the user's session. At any time during a user session, when the user presses the SAS key combination, Winlogon prompts for a security dialog box that typically includes options such as Sign out, start Task Manager, lock Task Manager, lock Computer, change password, shut down, and so on.

Windows subsystem Process (Csrss.exe)

As mentioned earlier in this chapter, the Windows subsystem process is responsible for providing a subsystem environment for the user, including the ability to provide a console window, and to create or delete processes and threads.

Local Security Authority subsystem process (Isass.exe)

It is responsible for local system security policies, such as which users are allowed to log on to the local system, password policies, privileges granted to users and user groups, and system security audit settings, and debugging is responsible for authenticating users and sending security audit messages to the system's event log.

Shell process (Explorer.exe)

This is the default shell for Windows, which provides a variety of interfaces for the system to interact with users, including interfaces that are familiar to almost all windows users, such as Start menus, taskbar, explorer windows, and so on.

Service Control Manager (Services.exe)

It is responsible for managing Windows system services, where system services refer to special processes that are usually not interacting with the logged-on user and are configured to automatically start up when the system boots without the need for an interactive logon process. There are many functional components in Windows that are implemented as a service, such as event logs, Task schedulers, and various network components.

Windows system processes