Have you ever browsed the Windows Task Manager and wondered what some of the entries were for? The Windows system process section, which is at the bottom of the list in the Windows 10 Task Manager, holds some processes that are critical to your computer running properly.
What do these processes do, and what would happen if you ended them? Let’s look at some of the most important entries.
Note: The new Task Manager in Windows 8.1 and 10 refers to some of these entries with friendlier names, like Windows Logon Application instead of winlogon.exe. If you’re using Windows 7, you’ll see the old-school names. Right-click one and choose Properties in Windows 8.1 or 10 to see its executable name.
Windows won’t let you kill the confusingly-named System entry through the Task Manager. That’s because it’s vitally important to the internals of your device. System handles tasks at the kernel level, such as hosting drivers to make sure that software can communicate with hardware.
You can imagine the consequences if you were to terminate this. Since vital drivers like accessing your disks and USB devices rely on System doing its job, closing it will lock up your system and require a hard reboot. If you need to restart System (maybe when troubleshooting high CPU usage), you should reboot your computer normally. Regular problems with this entry could indicate a hardware problem.
It’s not a true process, but it can use some of the CPU and thus Windows adds an entry for it in the Task Manager.
2. Windows Logon Application (winlogon.exe)
You might assume that this process isn’t too important once you’re logged into Windows, but it’s quite the opposite. Its first function is loading your user profile when you log in. Any Registry changes that you’ve made to only your account take effect when you log in thanks to this process.
Winlogon is also extremely important for security because it’s hard-wired to listen for the Ctrl + Alt + Del shortcut. When you’re logged in, this key combination brings up the Windows Security Screen, which contains a few quick links for you to change your password or sign out.
But you can also enable an option that requires you to press Ctrl + Alt + Del when logging into Windows. Because the three-finger salute is always caught by winlogon, pressing it ensures that you see the actual Windows logon screen and not a fake designed to steal your password.
To complete its duties, winlogon also displays the screen saver and/or locks your PC after you’ve been away for some time. If you try to use the End Process command on the Task Manager, Windows will warn you that this is a bad idea.
Do it anyway, and your PC will go completely black with no hope for recovery. You’d have to reboot to get it running again at that point.
3. Windows Startup Application (wininit.exe)
Wininit is a process that helps Windows get situated when you first log in and needs to stay running for the entire duration of your use. Its most important function is acting as a springboard for most background apps and processes that run when you start Windows. This includes starting other critical processes like lsass.exe and lsm.exe.
It runs until you shut your computer down. Trying to end it prematurely will result in a Windows prompt warning you not to do this. And like Winlogon, doing so anyway crashes the system to the point of needing a reboot.
And taskkill /f /im wininit.exe (wininit.exe causes a BSOD if terminated like csrss.exe)
— Giorarv262 (@Giorarv) March 12, 2017
4. Client Server Runtime Process (csrss.exe)
Another sibling in the essential Windows process family, csrss‘s role has changed throughout Windows’ evolution. In the really old days, this process handled all the graphical elements of Windows. But now, it handles a few background functions instead.
Its two most critical roles are shutting down Windows and launching the conhost.exe process, which launches the Command Prompt. This might not sound like much, but it’s a vital process. If something gets screwed up and this process doesn’t run at boot, you’ll see a blue screen.
As you might have guessed, ignoring Windows’ advice about ending this process will result in a frozen system.
5. Windows Session Manager (smss.exe)
Another critical part of the Windows boot process (see a theme here?), this process has been around in Windows since Windows 3.1.
Whenever Windows loads up, smss makes a few preparations first. It maps your drives and creates virtual memory paging, to name a few. Once it’s finished, it calls winlogon and you see the login screen.
Obviously, the Session Manager stays alive after you’ve logged in. It watches both winlogon and csrss to wait for either one of them to end. If this occurs as part of a routine, Windows will shut down as normal. But if either process ends unexpectedly, smss will freeze up your computer.
Like the above processes, trying to end this one through the Task Manager results in a warning and then a locked-up system.
6. Windows Shell Experience Host
Here’s a newer process that works almost exclusively with new elements of Windows 10. If you’ve used a previous version of Windows before, you’ve certainly noticed the fresh coat of paint that Windows 10 has applied to staples like the clock and calendar. The Shell Experience Host process handles these elements, along with the color and transparency effects of the Start Menu and Taskbar.
In addition to the updated look, this process also works to display Store apps in a window. If you use a slideshow as your wallpaper, you can thank Shell Experience Host for making it happen. Unlike many other processes on this list, closing it won’t crash your system. Instead, Windows will simply restart it after a few seconds. But there’s no reason to close it — doing so won’t instantly make your computer look more like Windows 7.
Ending windows shell experience host did nothing, it just restarts, no changes is viewable on screen.
— Joshua (@sweatshopking) July 29, 2017
7. Windows Explorer (explorer.exe)
This entry doesn’t hold Windows together, but it does handle much of the graphical interface you use every day. Terminating Windows Explorer will not only close any open File Explorer windows, but it will also render the Start Menu, Taskbar, and System Tray unusable.
However, restarting Explorer can actually prove helpful. If your Start Menu or Taskbar starts acting up, a quick restart of this process can clear up issues. It’s way faster than restarting your PC for a minor issue.
In Windows 8.1 and 10, you can right-click on Windows Explorer and choose Restart to instantly kill and re-run it. On Windows 7, you’ll have to right-click it and choose End Process, then go to File > Run new task and enter explorer.exe to get it going again.
What Other Processes Make You Wonder?
These seven processes certainly aren’t the only mission-critical ones running in your Task Manager. But they’re all vital to your Windows experience in some way. And now you know what they do! Thankfully, Windows protects you from doing something stupid and shutting these down, so you don’t have much to worry about.
Sometimes malware will pose as a real Windows process, but this isn’t as common as it once was. It helps to know how to handle suspicious processes in the Task Manager if you see them.
How many of these processes were you familiar with? Which Windows processes have raised your eyebrows before? Tell us the most confusing processes you’ve seen down in the comments!