What Is smss.exe and Why Is It Running?

You’re probably here because you’ve seen smss.exe in your Windows Task Manager and you want to know what it does and if it is anything you should be worried about. Here’s a look at what it is and why it’s running.

What is smss.exe?

Well, we have good news for you. smss.exe is nothing to be worried about and certainly isn’t malware. It is a process that’s been part of the Microsoft Windows family of operating systems ever since Windows NT 3.1 and it is executed during the startup process.

smss.exe’s full name is the Session Manager Subsystem, it is located in the \system32 subdirectory of your Windows directory and can be classified as a Windows system file.

Its job is to start a user’s session and it should not be stopped or disabled, as it is crucial in order for your system to run. It starts running during startup and then it helps launch winlogon.exe – the Windows logon manager and csrss.exe (discussed here); it sets environment variables and also works on other Windows activities.

After starting, smss.exe will reside in the memory and you can see it in Task Manager, waiting for the two processes mentioned above, winlogon.exe and csrss.exe to stop. If they don’t stop in regular fashion, the system may hang because of it.

Vulnerability

Since we’re talking about a Windows system process, and a critical one at that, it’s normal for smss.exe to be targeted by malware.

There have been situations when various types of malware have tried to duplicate smss.exe. Then, they’ve proceeded to use it as a trojan or worm. However, if the definitions on your antivirus software are up-to-date, you probably shouldn’t worry about anything of the sort.

Conclusion

smss.exe is an important Windows system file and an integral part of the operating system’s startup. Running it is safe and it should not be disabled or stopped, as that could cause system instability.