# smss.exe

Windows Process: Microsoft Corporation

Catalog search terms smss, session manager, windows session manager

Windows, System Component

Session Manager Subsystem. Na di first user-mode process and e dey create sessions, including di one wey dey start csrss.exe.

## Wetin you need know

Dis na Session Manager, di first user-mode process after di kernel.

smss.exe dey create sessions and dey start csrss.exe and wininit.exe. To end am go crash Windows. E no be background app wey you install.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **I suppose end am?**: No

  **First user-mode process?**: Yes

Feex tok say

I no dey hunt smss for high RAM. If Session Manager na di worry, I dey check say di file dey inside System32 and get valid signature, den I go move on.

## Wetin be smss.exe?

smss.exe na Session Manager Subsystem. Na di first user-mode process wey di kernel dey start. E dey create environment variables, page files, and new sessions.

## Wetin e dey do?

Persistent smss dey stay resident. Short-lived copies dey start csrss and winlogon for new session, den dem go exit. Dat pattern normal and e no be fork bomb.

## Wetin make am dey run?

Boot reach user mode. You dey see smss because Windows need session factory. E no belong to Chrome abi Defender.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'smss.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check dis running file

Di real Session Manager dey inside System32. smss.exe wey dey beside game crack dey only use di name, no be di real work.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\smss.exe`

- Expected publisher: Microsoft Corporation
- First user-mode process
- Extra copies fit be session startup helpers wey dey exit

## I fit end am?

No

To end smss.exe na critical failure. Windows go bugcheck abi drop di session.

## I fit comot am?

No

No delete smss.exe. Windows session no go dey without Session Manager.

## E suppose start with Windows?

Di kernel dey start smss. E no dey listed beside Discord for Startup Apps.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | smss.exe                                                                           |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\smss.exe                                                       |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### Two smss.exe rows

Helper copy fit show while new session dey start, den e go disappear. Na normal documented session startup, no be duplicate OS.

### Name inside user folder

Treat any non-System32 smss as hostile until signature talk otherwise.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Count how long di extra copy take live

Helper wey dey exit after logon dey expected. Second copy wey stay for hours from temp path no normal.

### No replace di file from "fix" zip

Session Manager replacements na classic malware style.

## Technical details

Technical details

| Image name | smss.exe                  |
| ---------- | ------------------------- |
| Role       | Session Manager Subsystem |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[csrss.exe: Windows Process](https://feex.it/wiki/l/pcm/process/csrss.exe/)[wininit.exe: Windows Process](https://feex.it/wiki/l/pcm/process/wininit.exe/)[Wetin bi Windows process: Guide](https://feex.it/wiki/l/pcm/software/system/what-is-a-windows-process/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: Session Manager ](https://learn.microsoft.com/windows-hardware/drivers/debugger/debugging-the-session-manager)· smss and session creation
- [Microsoft Learn: Windows ](https://learn.microsoft.com/windows)· Primary Windows documentation
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: smss.exe

  **Typical path**: C:\Windows\System32\smss.exe

  **Record context**: Feex Wiki reference entry

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/smss.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)