Hello all,

I have a 2008 standard server with WSUS service installed. My question is why wsusservice.exe is creating csrss.exe as a child along with winlogon.exe when everywhere I have read says csrss.exe should only be the child of smss.exe. 

I have checked with multiple other servers and desktops (win8,7,2k12,2k8 without wsus) and smss is always the parent of csrss.exe. So I am guessing it has something to do with the WSUS service but I am not sure why it would be creating csrss.exe and winlogon.exe.

Any help would greatly be appreciated!

P.S I cant provide much info because IT wont let me but I am in the process of trying to recreate the situation in some VM's. If I can reproduce the csrss.exe occurrence I will post process details. 

The only info I have currently is that Wininit.exe is the parent to services.exe, which is the parent to wsusservices.exe which is the parent to csrss.exe.

Thanks,

Chris

• Edited by crayy8 Thursday, January 29, 2015 9:17 PM

Hi Chris,

I have checked it in my lab and can't find a csrss process created by wsusservice.exe.

>>I have read says csrss.exe should only be the child of smss.exe. 

CSRSS runs as a user-mode system service. When a user-mode process calls a function involving console windows, process/thread creation, or side-by-side support, instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.

Best Regards.