JSI Tip 2789. What processes run by default, on Windows 2000 Professional?

Csrss.exe

The user-mode portion of the Win32 subsystem. The client/server run-time subsystem is responsible for console windows, creating/deleting threads, and a portion of the 16-bit virtual MS-DOS environment.

Explorer.exe

The default user shell manages the taskbar, desktop, start menu, etc.

Internat.exe

Loads the input locals from HKEY_USERS.DEFAULTKeyboard LayoutPreload and the EN icon in the system tray.

Lsass.exe

The local security authentication server generates the process responsible for winlogon authentication. Using the authentication package, Msgina.dll, it generates the user's access token.

Mstask.exe

The Task Scheduler is responsible for running jobs at a predetermined time.

Smss.exe

The session manager starts the user session, launches Winlogon and Csrss, and sets the environment variables. It shuts down if the session initiates normally.

Spoolsv.exe

The printer/fax spooler.

Svchost.exe

See tip 2060.

Services.exe

The Services Control Manager starts, stops, and controls the interaction with services.

System

Most system kernel-mode threads run as the System process.

System Idle Process

A single thread per processor that accounts for idle processor time. It should account for the majority of processor time.

Taskmgr.exe

The Task Manager that you are currently using to view the processes.

Winlogon.exe

Manages logon and logff, when CTRL+ALT+DEL or a logoff/shutdown is invoked.

Winmgmt.exe

The core component of client management. It initializes when the first client application connects and continuously when management application request its' services.