Activation Context Creation flow
The following describes how activation context is created currently in Windows XP/Windows Server 2003/Windows Vista.
1. CreateProcess/CreateActCtx is called.
2. CreateProcess/CreateActCtx does some validation, constructs a message, sends the message to CSRSS.exe, and waits for CSRSS.exe to return.
3. CSRSS.exe receives the message, and creates the activation context as described in https://blogs.msdn.com/junfeng/archive/2006/04/22/580482.aspx.
4. Once the activation context is created, CSRSS returns it to the client.
5. CreateProcess/CreateActCtx proceeds.
The getaway from the flow above is: most work is done in CSRSS.exe.