Search notes:

csrss.exe

The Client Server Runtime Sub-System process.
CSRSS is a user-mode process.
The process might be started with the following arguments 
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
For each session, an instance of csrss.exe is created which in turn loads the important DLLs for a Windows subsystem.
csrss.exe has the Windows subystem's raw input thread which handles keyboard and mouse input.
The CSRSS can be debugged by setting the System Global Flag Debug initial command.
See also the System Global Flag Enable debugging of Win32 subsystem (FLG_ENABLE_CSRDEBUG)

See also

The value of Windows under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems.
In order to debug csrss.exe, the Enable debugging of Win32 subsystem tick needs to be set with gflags.exe. Alternatively, this can be done on a command line with 
C:\> gflags /r +20000
The -- (two hyphens!) command line option of the debugging tools for Windows.

Index