Windows NT default processes

Process Name	File Name	Definition
System Idle Process		A process that runs to occupy the processors when they are not executing other threads. Idle has one thread per processor.
System		Contains system threads that handle lazy writing by the file system cache, virtual memory modified page writing, working set trimming, and similar system functions.
SMSS	SMSS.EXE	Session Manager Subsystem
CRSS	CRSS.EXE	Client Server Runtime Subsystem, provides text window support, shutdown, and hard-error handling to the Windows NT environment subsystems.
WINLOGON	WINLOGON.EXE	Logon process executable. It manages logon and logoff of users and remote Performance Monitor data requests.
SERVICES	SERVICES.EXE	This process is shared by the Windows NT Services Control Manager, which starts all services, and a group of Windows NT 32-bit services, including Alerter, Clipbook Server, Computer Browser, Event Viewer, Messenger, Server and Workstation, and Plug and Play.
LSASS	LSASS.EXE	Local Security Administration Subsystem, the process running the Local Security Authority component of the Windows NT Security Subsystem. This process handles aspects of security administration on the local computer, including access and permissions. The Net Logon service shares this process.
NDDEAGNT	NDDEAGNT.EXE	Network Dynamic Data Exchange (DDE) Agent, handles requests for network DDE services.
RPCSS	RPCSS.EXE	Remote Procedure Call (RPC subsystem) which includes the RPC service and RPC locator.
SPOOLSS	SPOOLSS.EXE	Spooler Subsystem controls despooling of printer data from disk to printer.
EXPLORER	EXPLORER.EXE	Windows NT Explorer, a segment of the user interface which lets users open documents and applications from a hierarchical display.
TASKMGR	TASKMAN.EXE	Task Manager executable.
PSTORES	PSTORES.EXE	Protected Storage Service
LLSSRV	LLSSRV.EXE	License Logging Service, the service that logs the licensing data for License Manager in Windows NT Server and the Licensing option in Control Panel on both Windows NT Server and Workstation.
NTVDM	NTVDM.EXE / Wowexec.exe	NT Virtual DOS Machine, which simulates a 16-bit environment for MS-DOS and 16-bit Windows applications.