# smss.exe

Windows Process: Microsoft Corporation

Also called smss, session manager, windows session manager

Windows, System Component

Session Manager Subsystem. It is the first user-mode process and it creates sessions, including the one that starts csrss.exe.

## What you need to know

This is Session Manager, the first user-mode process after the kernel.

smss.exe creates sessions and starts csrss.exe and wininit.exe. Ending it collapses Windows. It is not a background app you installed.

- **Safe?**: Yes, in System32

  **Should I end it?**: No

  **First user-mode process?**: Yes

Feex says

I do not hunt smss for high RAM. If Session Manager is the worry, I check that the file is in System32 and signed, then I move on.

## What is smss.exe?

smss.exe is Session Manager Subsystem. It is the first user-mode process the kernel starts. It creates environment variables, page files, and new sessions.

## What does it do?

A persistent smss stays resident. Short-lived copies start csrss and winlogon for a new session, then exit. That pattern is normal and is not a fork bomb.

## Why is it running?

Boot reached user mode. You see smss because Windows needs a session factory. It does not belong to Chrome or Defender.

## Is it safe?

Usually safe

The real Session Manager is in System32. An smss.exe next to a game crack is using the name, not the role.

A legitimate copy normally runs from:

`C:\Windows\System32\smss.exe`

- Expected publisher: Microsoft Corporation
- First user-mode process
- Extra copies can be session startup helpers that exit

## Can I end it?

No

Ending smss.exe is a critical failure. Windows will bugcheck or drop the session.

## Can I remove it?

No

Do not delete smss.exe. There is no Windows session without Session Manager.

## Should it start with Windows?

The kernel starts smss. It is not listed next to Discord in Startup Apps.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Idle after sessions exist

  **Memory**: Very small

  **Disk**: Low after page-file setup

  **Network**: None

## File information

| Executable name        | smss.exe                     |
| ---------------------- | ---------------------------- |
| Common legitimate path | C:\Windows\System32\smss.exe |
| Publisher              | Microsoft Corporation        |
| Signature expectation  | Signed by Microsoft Windows  |

## Common problems

### Two smss.exe rows

A helper copy can appear while a new session starts, then vanish. That is documented session startup, not a duplicate OS.

### Name in a user folder

Treat a non-System32 smss as hostile until a signature says otherwise.

## Troubleshooting

Diagnose before you change anything destructive.

### Count how long the extra copy lives

A helper that exits after logon is expected. A second copy that stays for hours from a temp path is not.

### Do not replace the file from a "fix" zip

Session Manager replacements are a classic malware move.

## Technical details

Technical details

| Image name | smss.exe                  |
| ---------- | ------------------------- |
| Role       | Session Manager Subsystem |

## Related

These entities connect to this article. Type is shown on every link.

[csrss.exe: Windows Process](https://feex.it/wiki/process/csrss.exe)[wininit.exe: Windows Process](https://feex.it/wiki/process/wininit.exe)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Session Manager ](https://learn.microsoft.com/windows-hardware/drivers/debugger/debugging-the-session-manager)· smss and session creation
- [Microsoft Learn: Windows ](https://learn.microsoft.com/windows)· Primary Windows documentation
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: smss.exe

  **Typical path**: C:\Windows\System32\smss.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/smss.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)