Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I kill wininit.exe, Windows 7 suddenly shuts down. Can someone explain this using Windows mechanics?

I feel like this might because the process provides something important, or this might be a security feature.

share|improve this question
    
This is pure speculation, but I'd guess wininit is similar to linux's init. This starts every other running process (and they are therefore its child processes), so killing it shuts down every process - thereby shutting down the system. –  handuel Mar 16 at 13:57
3  
That speculation is wrong, and there is a specific Windows NT mechanism at play here, as mentioned in some of the answers. –  JdeBP Mar 16 at 14:50
7  
To a lot of people, killing wininit.exe (a system process) causing a crash is not at all a surprise, so you may want to explain why you have asked the question at all. It is analogous to asking Hey, why does my system turn off when I yank out the power cord?; there is a perfectly good, but too obvious answer, so some people may think it is silly and pointless. My best guess why you are asking is because you think it is supposed to be only part of the boot process because of the name, and so you expect it to not be used after a successful boot up. –  Synetech Mar 16 at 21:39
    
@Synetech I do not find the matter as transparent as you seem to. –  Simon Kuang Mar 17 at 19:07
1  
Sure, but a remark about why you find it surprising would lend more credence to the question. Sometimes people ask questions that seem too obvious which are looked down upon because others think that the poster is not really looking for an answer and is only trying to farm some rep points. Your question could fall in either category, and I just thought an explanation of your confusion would help clarify. This question seems obvious because wininit.exe is a high-priority, protected, SYSTEM process and not easily ended, so it should not be a surprise that it causes problems if killed. –  Synetech Mar 18 at 1:23

4 Answers 4

up vote 34 down vote accepted

From Windows Internals, Part 1

Windows Initialization Process (Wininit.exe)

  • Marks itself critical so that if it exits prematurely and the system is booted in debugging mode it will break into the debugger (if not, the system will crash).
  • Initalizes the user-mode scheduling infrastructure.
  • Creates the %windir%\temp folder
  • Creates a window station (Winsta0) and two desktops (Winlogon and Default) for processes to run in session 0.
  • Creates Services.exe (Service Control Manager or SCM).
  • Starts Lsass.exe (Local Security Authentication Subsystem Server).
  • Starts Lsm.exe (Local Session Manager).
  • Waits forever for system shutdown.
share|improve this answer
4  
+1 A sourced and detailed answer — what a rarity –  kinokijuf Mar 16 at 16:15

This is correct. wininit.exe is flagged as critical.

enter image description here

and killing critical system processes is not allowed and Windows will bugcheck the system with CRITICAL_OBJECT_TERMINATION

share|improve this answer

A post on groovypost.com explains the origin of winit.exe ("Windows Initialize") and that today it primarily acts as a launcher for the majority of the background applications that are always running.

Look at the screenshot in that blog post which explains that killing the wininit.exe process will also affect anything that was launched by that process:

[...] wininit.exe is a critical system process the Windows requires in order to function. Ending this process will likely result in a critical system error in which you’ll need to restart your computer. As you can see in the chart below, wininit.exe is at the top of the process tree for all of windows services, including svchost.exe.

process explorer screenshot

share|improve this answer
1  
But killing a process in Windows does not force termination of the processes it's created. Windows doesn't work that way. –  Jamie Hanrahan Aug 11 at 2:37

The wininit.exe process is the windows start up application which is found in the %systemroot%\system32 folder (in most systems, %systemroot% maps to C:\Windows).

During boot, the smss.exe process creates wininit, which in turn create the lsass.exe (Local Security Authority Subsystem), services.exe (the services controller manager), and lsm.exe (Local Session Manager).

Like the csrss.exe process, termination of the wininit.exe process will crash the machine with STOP Code 0xF4 (CRITICAL_OBJECT_TERMINATION) (but interestingly, suspending the process is possible).

Since wininit.exe is in the system32 folder, if wininit.exe is found outside of it's folder (in C:\Windows\ or in your application data folder), then it is most likely malicious.

share|improve this answer
    
This just duplicates David Marshall’s answer. –  kinokijuf Mar 16 at 21:20
2  
@kinokijuf, still 10 reps earned (and that's just so far), not bad =) –  zespri Mar 17 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.