smss.exe

Windows ProcessMicrosoft Corporation

Also called smss, session manager, windows session manager

WindowsSystem Component

Session Manager Subsystem. It is the first user-mode process and it creates sessions, including the one that starts csrss.exe.

What you need to know

This is Session Manager, the first user-mode process after the kernel.

smss.exe creates sessions and starts csrss.exe and wininit.exe. Ending it collapses Windows. It is not a background app you installed.

Safe?: Yes, in System32
Should I end it?: No
First user-mode process?: Yes

Feex says

I do not hunt smss for high RAM. If Session Manager is the worry, I check that the file is in System32 and signed, then I move on.

What is smss.exe?

smss.exe is Session Manager Subsystem. It is the first user-mode process the kernel starts. It creates environment variables, page files, and new sessions.

What does it do?

A persistent smss stays resident. Short-lived copies start csrss and winlogon for a new session, then exit. That pattern is normal and is not a fork bomb.

Why is it running?

Boot reached user mode. You see smss because Windows needs a session factory. It does not belong to Chrome or Defender.

Is it safe?

Usually safe

The real Session Manager is in System32. An smss.exe next to a game crack is using the name, not the role.

A legitimate copy normally runs from:

C:\Windows\System32\smss.exe

Expected publisher: Microsoft Corporation
First user-mode process
Extra copies can be session startup helpers that exit

Can I end it?

Ending smss.exe is a critical failure. Windows will bugcheck or drop the session.

Can I remove it?

Do not delete smss.exe. There is no Windows session without Session Manager.

Should it start with Windows?

The kernel starts smss. It is not listed next to Discord in Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Idle after sessions exist
Memory: Very small
Disk: Low after page-file setup
Network: None

File information

smss.exe file information
Executable name	smss.exe
Common legitimate path	C:\Windows\System32\smss.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Two smss.exe rows

A helper copy can appear while a new session starts, then vanish. That is documented session startup, not a duplicate OS.

Name in a user folder

Treat a non-System32 smss as hostile until a signature says otherwise.

Troubleshooting

Diagnose before you change anything destructive.

Count how long the extra copy lives

A helper that exits after logon is expected. A second copy that stays for hours from a temp path is not.

Do not replace the file from a "fix" zip

Session Manager replacements are a classic malware move.

Technical details

smss.exe technical details
Image name	smss.exe
Role	Session Manager Subsystem

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Session Manager · smss and session creation
Microsoft Learn: Windows · Primary Windows documentation
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.