Have you ever browsed the Windows Task Manager and wondered what some of the entries were for? The Windows system process section, which is at the bottom of the list in the Windows 10 Task Manager, holds some processes that are critical to your computer running properly.
What do these processes do, and what would happen if you ended them? Let's look at some of the most important entries in the Windows Task Manager.
Note: The newer Task Manager in Windows 8.1 and later refers to most system entries with friendly names, like Windows Logon Application instead of winlogon.exe. If you're using Windows 7, you'll see the executable file names. In later versions of Windows, right-click one and choose Properties to see its executable name.
1. System (ntoskrnl.exe)
Windows won't let you kill the confusingly named System entry through the Task Manager. That's because it's vitally important to the internals of your device. System handles tasks at the kernel level, such as hosting drivers to make sure that software can communicate with hardware.
You can imagine the consequences if you were to terminate this. Since vital drivers like accessing your disks and USB devices rely on System doing its job, closing it will lock up your system and require a hard reboot. If you need to restart System (maybe when troubleshooting high CPU usage), you should reboot your computer normally. Regular problems with this entry could indicate a hardware problem.
2. Windows Logon Application (winlogon.exe)
You might assume that this process isn't too important once you're logged into Windows, but it's quite the opposite. Its first function is loading your user profile when you log in. Any Registry changes that you've made to only your account take effect when you log in, thanks to this process.
Winlogon is also extremely important for security because it's hard-wired to listen for the Ctrl + Alt + Del shortcut. When you're logged in, this key combination brings up the Windows Security Screen, which contains a few quick links for you to change your password, sign out, and similar.
But you can also enable an option called Secure sign-in that requires you to press Ctrl + Alt + Del when logging into Windows. Because the "three-finger salute" is always caught by winlogon, pressing it ensures that you see the actual Windows logon screen and not a fake designed to steal your password.
To complete its duties, winlogon also displays the screen saver and/or locks your PC after you've been away for some time. If you try to use the End Process command on the Task Manager, Windows will warn you that this is a bad idea.
Do it anyway, and your PC will go completely black with no hope for recovery. You'd have to reboot to get it running again at that point.
3. Windows Start-Up Application (wininit.exe)
Wininit is a process that helps Windows get situated when you first log in, and needs to stay running for the entire duration of your use. Its most important function is acting as a springboard for most background apps and processes that run when you start Windows. This includes starting other critical processes like lsass.exe and lsm.exe.
It runs until you shut your computer down. Trying to end it prematurely will result in a Windows prompt warning you not to do this. And like Winlogon, doing so anyway crashes the system to the point of needing a reboot.
4. Client Server Runtime Process (csrss.exe)
Another sibling in the essential Windows process family, csrss's role has changed throughout Windows' evolution. In the really old days, this process handled all the graphical elements of Windows. But now, it handles a few background functions instead.
Its two most critical roles are shutting down Windows and launching the conhost.exe process, which launches the Command Prompt. This might not sound like much, but it's a vital process. If something gets screwed up and this process doesn't run at boot, you'll get a blue screen.
As you might have guessed, ignoring Windows' advice about ending this process will result in a frozen system.
5. Windows Session Manager (smss.exe)
Another critical part of the Windows boot process (see a theme here?), the Windows Session Manager process has been around since Windows 3.1.
Whenever Windows loads up, smss makes a few preparations first. It maps your drives and creates virtual memory paging, to name a few. Once it's finished, it calls winlogon and you see the login screen.
Obviously, the Session Manager stays alive after you've logged in. It watches both winlogon and csrss to wait for either one of them to end. If this occurs as part of a standard routine, Windows will shut down as normal. But if either process ends unexpectedly, smss will freeze up your computer.
Like the above processes, trying to end this one through the Task Manager results in a warning and then a locked-up system.
6. Windows Shell Experience Host
Here's a newer process that works almost exclusively with elements new to Windows 10. If you've used a previous version of Windows, you likely noticed the fresh coat of paint that Windows 10 applied to staples like the clock and calendar. The Shell Experience Host process handles these elements, along with the color and transparency effects of the Start menu and Taskbar.
In addition to the updated look, this process also works to display Store apps in a window. If you use a slideshow as your wallpaper, you can thank Shell Experience Host for making it happen. Unlike many other processes on this list, closing it won't crash your system. Instead, Windows will simply restart it after a few seconds. But there's no reason to close it—doing so won't change the look of Windows.
7. Windows Explorer (explorer.exe)
This entry doesn't hold Windows together, but it does handle much of the graphical interface you use every day. But what happens if you end Windows Explorer in the Task Manager?
As it turns out, terminating Windows Explorer will not only close any open File Explorer windows, but it will also render the Start menu, Taskbar, and System Tray unusable.
However, restarting Explorer can actually prove to be helpful. If your Start Menu or Taskbar starts acting up, a quick restart of this process can clear up issues. It's much faster than restarting your PC for a minor issue limited to Windows Explorer.
In Windows 8.1 and later, you can right-click on Windows Explorer and choose Restart to instantly kill and re-run it. On Windows 7, you'll have to right-click it and choose End Process, then go to File > Run new task and enter explorer.exe to get it going again.
There are other ways to restart File Explorer if needed, so be aware of them for the next time you accidentally end Windows Explorer's task.
Be Aware of Critical Windows Processes
The processes we've looked at certainly aren't the only mission-critical ones running in your Task Manager. But they're all vital to your Windows experience in some way, and now you know what they do.
Thankfully, in most cases, Windows protects you from doing something stupid and shutting these down, so you don't have much to worry about.
Meanwhile, the Task Manager is useful for a lot more than you might think. It's hiding handy tools beyond letting you view system processes.
