This step is critical because the default dbghelp.dll that comes with Windows is often outdated. By pointing Process Explorer to the advanced version that comes with WinDbg, you allow it to perfectly translate raw memory addresses into readable function names (like kernelbase!CreateFile).
Here is exactly how to configure it:
1. Find your WinDbg installation folder
Depending on how you installed WinDbg (via the Windows SDK or the standalone installer), your dbghelp.dll is usually located in one of these default paths:
64-bit Windows SDK:C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll
32-bit Windows SDK:C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbghelp.dll
Windows Store App version: Usually hidden, so it is best to download the SDK version if you can’t find it.
2. Configure Process Explorer
In Process Explorer, click Options at the top.
Select Configure Symbols…
In the Dbghelp.dll path box, click the ... button and browse to the path you found in Step 1.
3. Set the Symbol Path
While you have that window open, you should also fill out the Symbols path box right below it. This tells Process Explorer to automatically download the translation files directly from Microsoft’s servers.
Copy and paste this exact string into the Symbols path box:
(This tells Process Explorer: “Download the symbols from Microsoft and save them to a folder called C:\symbols so you don’t have to download them again.“)
4. Apply and Verify
Click OK. Process Explorer might freeze for a few seconds the first time you look at a process’s threads as it reaches out to Microsoft’s servers to download the symbols.
Explorer.exe & csrss.exe
Which process is the parent of explorer.exe?
If you open the properties of explorer.exe (your Windows desktop and taskbar) and look at the Parent field on the Image tab, it will likely say <Non-existent Process>!
The internal reason: When you log into Windows, winlogon.exe launches a temporary setup program called userinit.exe. userinit.exe launches your desktop (explorer.exe), and then it immediately kills itself to save memory. Because userinit.exe is dead, explorer.exe is left as an orphan justified to the left of the screen.
Which process is the parent of csrss.exe?
Just like explorer.exe, the parent of csrss.exe (Client/Server Run-Time Subsystem) is also <Non-existent Process>.
The internal reason: Very early in the boot process, the Session Manager (smss.exe) creates csrss.exe to handle critical background OS tasks. The specific instance of smss.exe that spawned it does its job and exits, leaving csrss.exe orphaned on the left edge of the screen for the rest of the time the computer is turned on.
