Windows file
csrss.exe (Client Server Runtime Process): genuine Windows process, or a fake?
csrss.exe is the Client Server Runtime Process, a core Windows process that handles console windows and process and thread creation, and takes part in shutdown. The copy in C:\Windows\System32 is safe and cannot be ended. A csrss.exe in any other folder is not Windows.
Prefer to check it yourself? The manual checks follow.
csrss.exe in C:\Windows\System32, signed by Microsoft, is safe and essential. Ending it makes Windows stop with an error and restart, so do not try to remove it. One instance per Windows session is normal, so two or more can run.
The name is copied by malware because nobody questions it. Judge a csrss.exe by its folder and signature, not its name. Spam attachments are the most common way such files arrive, so do not open attachments you did not expect and confirm with the sender first.
- Task Manager name
- Client Server Runtime Process (csrss.exe, Details tab)
- Description in the file
- Client Server Runtime Process
- Genuine folder
- C:\Windows\System32\csrss.exe
- Signed by
- Microsoft (all 17 known Microsoft builds are signed)
- Windows releases
- Windows 10 1507 to Windows 11 26H1
- Newest build indexed
- 10.0.28000.1896 (KB5124006), Windows 11 26H1
- Several copies
- Normal; one per Windows session
- Can it be ended
- No; Windows stops with an error
What the Client Server Runtime Process does
In the first Windows NT versions csrss.exe drew the graphical interface: windows, the screen and related functions. With Windows NT 4.0 in 1996 most of that work moved into the kernel. The process kept the console windows, the creation and deletion of processes and threads, and part of the shutdown process.
Windows cannot run without it. If the process ends, the system halts with a stop error and restarts, which is a safeguard against damage. The process starts early in the boot sequence, before you sign in.
Windows starts one csrss.exe for each session, so a PC normally shows two (the system session and your own). More appear when several users are signed in, or with remote sessions.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check a csrss.exe
Three checks need nothing installed.
- Where the file is. In Task Manager, Details tab, right-click csrss.exe and choose Open file location. Open Properties there. The genuine file is C:\Windows\System32\csrss.exe. A copy in a user folder, AppData, Temp or ProgramData is not Windows.
- Who signed it. On the Digital Signatures tab in Properties the signer must be Microsoft Windows and the status valid. The command prints the path and signer of every instance:
Get-Process csrss | Select-Object Id, SessionId, Path | ForEach-Object { $_ ; (Get-AuthenticodeSignature $_.Path).Status } - The name's spelling. Lookalikes such as csrs.exe, cssrs.exe or csrss.exe with a digit instead of a letter are different files.
- Compare the file with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds.
A matching path and signature show that the file is the Windows one, and malware hides well, so some threats pass a quick look. If the signs below apply but the file passes, run Microsoft Defender's full scan and the offline scan.
Check your csrss.exe
Choose the csrss.exe you are unsure about. Its SHA-256 checksum is calculated in your browser and compared with the 17 Microsoft builds indexed from Windows releases and updates.
The file stays on your computer. Nothing is uploaded: the checksum is computed locally.
Warning signs and what they mean
| What you see | What it means |
|---|---|
| csrss.exe outside C:\Windows\System32 | Not the Windows file. A program is borrowing the name to hide. |
| Signature missing, invalid or not Microsoft's | The file was replaced or does not come from Microsoft. |
| More csrss.exe processes than you have sessions | Worth checking each path and signature. The old advice treated more than two as a sign of infection; with several users or remote sessions it can be normal. |
| Misspelled lookalike names | Used to pass a glance at the process list. |
| csrss.exe started from a user folder, a downloaded archive or a mail attachment | The genuine process is started by Windows at boot, never from a file you opened. |
Everyday problems that are not malware
Why are there two csrss.exe processes?
Windows starts one per session, one for the system session and one for the signed-in user. Remote and fast user switching sessions add more.
Can I end csrss.exe in Task Manager?
Windows warns that ending it will make the system unusable, and if you go on it stops with an error and restarts. End a csrss.exe only if it failed the folder and signature checks.
csrss.exe versions by Windows release
The newest build indexed for each release, and the update that delivered it. 17 Microsoft builds in total are known.
| Windows release | File version | Delivered by | Size, 64-bit |
|---|---|---|---|
| Windows 11 26H1 | 10.0.28000.1896 | KB5124006, Sep 22, 2026 | 38,808 bytes |
| Windows 11 25H2 | 10.0.26100.1 | original release | 38,576 bytes |
| Windows 11 24H2 | 10.0.26100.1 | original release | 38,576 bytes |
| Windows 11 23H2 | 10.0.22621.1 | original release | 38,616 bytes |
| Windows 11 22H2 | 10.0.22621.1 | original release | 38,616 bytes |
| Windows 11 21H2 | 10.0.22000.1 | original release | 37,576 bytes |
| Windows 10 22H2 | 10.0.19041.3636 | KB5066198, Sep 25, 2025 | 18,784 bytes |
| Windows 10 21H2 | 10.0.19041.3636 | KB5129236, Sep 14, 2026 | 18,784 bytes |
| Windows 10 21H1 | 10.0.19041.546 | original release | 17,600 bytes |
| Windows 10 20H2 | 10.0.19041.546 | KB5026361, May 9, 2023 | 17,600 bytes |
Questions people ask
Is csrss.exe a virus?
No. It is the Windows Client Server Runtime Process and Windows cannot run without it. Malware can copy its name, so check the folder and signature: the genuine file is in C:\Windows\System32 and signed by Microsoft.
Should I remove csrss.exe from Windows?
No, not the genuine one. It cannot be ended without Windows stopping with an error. Remove only a csrss.exe outside System32 or without a Microsoft signature, using Microsoft Defender's full scan and, if needed, the offline scan.
Is there a csrss.exe trojan?
Yes, files named csrss.exe in other folders are used to hide. Our guide covers that fake, Csrss.exe trojan (remove-csrss-exe-trojan.html). The real file in System32 is not the trojan, so do not delete it. Check the folder and signature first; only a copy that fails both is the fake, and the guide explains its removal.
Why are several csrss.exe processes running?
One runs for each Windows session, so two is normal on a typical PC, and more appear with several signed-in users or remote sessions. Check each one's path and signature instead of counting. A copy that fails either check is not Windows, whatever the number of processes is.
What happens if I try to end csrss.exe?
Windows warns that the system will not operate correctly and, if you continue, it stops with an error and restarts. It does not simply refuse. It does this because the process is required for Windows to run.
How do I remove a fake csrss.exe if Defender does not remove it?
Restart in Safe Mode with Networking and run a Microsoft Defender full scan, then the Microsoft Defender Offline scan, which runs before Windows loads. Do not delete files by hand unless the path and signature check showed they are not Windows.
Sources
- MITRE ATT&CK T1036.005: Masquerading, Match Legitimate Resource Name or Location
- MITRE CAR-2021-04-001: Common Windows Process Masquerading
- Winbindex, the Windows binaries index (m417z)
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…