Insights Blog

This blog is dedicated to insights we had about other technologies during software development. Typically, the entries are related to problems taking us significant time to solve, and we could not find help in the internet faster than it took to solve the problem by our own. Of course, what we found in the net certainly contributed to our results. Just we hope it's valuable to share what we discovered by our own.

High csrss.exe Activity

The problem:

csrss.exe is instantiated heavily and takes significant performance.

The environment:

Windows Server 2003 Standard Edition

The reason:

Attempts of alien logons to RDP loaded winlogon.exe and csrss.exe. This is due to the fact that we allowed to use client credentials for RDP logon. It seams that Windows issues a new RDP session and only then checks the credentials.

The solution:

Reqest always a password for RDP logon. This seams to be checked before the RDP sessin is instantiated.

Open the terminal services configuration (tscc) and the the properties of the RDP-tcp connection. There you can find a switch to always demand the password. Enable this switch. (Sorry, we only have German versions of Windows here and can't give the exact wording).

(Issued 06/17/2010)