csrss.exe

Windows ProcessMicrosoft Corporation

Also called csrss, client server runtime

WindowsSystem Component

Client Server Runtime Process. A critical Windows process that must keep running.

What you need to know

This is a critical Windows process. Leave it alone.

csrss.exe is part of the Windows runtime. Ending it can force a shutdown or a crash. It is not a leftover installer.

Safe?: Yes, if it is in System32
Can I end it?: No
Can I delete it?: No

Feex says

I do not end csrss.exe. If someone told you to delete it to free RAM, they gave you a bad instruction.

What is csrss.exe?

csrss.exe is Client Server Runtime Subsystem. It is a core Windows process that has been part of NT-based Windows for decades.

What does it do?

It handles parts of the console and process shutdown path that user apps are not supposed to own. The exact duties shifted over versions. The rule stayed: do not kill it.

Why is it running?

Windows starts it at boot. You did not install it.

Is it safe?

Critical and normally safe

The legitimate file is in System32. A second csrss.exe in a user folder is not the Windows copy. Do not delete System32 to chase that rumor.

A legitimate copy normally runs from:

C:\Windows\System32\csrss.exe

Expected publisher: Microsoft Corporation
Expected path: System32 only

Can I end it?

Ending csrss.exe can crash the session. Task Manager may refuse. That is by design.

Can I remove it?

Do not delete csrss.exe. Windows will not run correctly without it.

Should it start with Windows?

It starts with Windows. You cannot and should not remove it from startup.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Normally low
Memory: Modest
Disk: Low
Network: None as a user-facing service

File information

csrss.exe file information
Executable name	csrss.exe
Common legitimate path	C:\Windows\System32\csrss.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Someone said it is a virus

The name is a favorite scare. Check the path. System32 plus a Microsoft signature is the expected file.

Two copies

Session 0 and an interactive session can each have a copy. That is not automatically malware.

Troubleshooting

Diagnose before you change anything destructive.

Confirm the path and signature

Open the process properties and check that csrss.exe runs from the expected folder and is signed by the expected publisher. This is the first check, not a Registry edit.

See what the process is doing

Task Manager can show CPU, memory, disk, and GPU. High use during an obvious job is often normal. High use when the PC is idle needs a closer look at the related app or service.

Avoid destructive first steps

Do not delete csrss.exe, disable critical services without knowing the effect, or edit the Registry as the first move.

Technical details

csrss.exe technical details
Image name	csrss.exe
Role	Critical Windows subsystem process

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Windows subsystem processes · Kernel and subsystem documentation

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.