Winlogon Role in Windows 2000 Security Shell

In Microsoft Windows 2000, the Winlogon process (winlogon.exe) is the core user-mode component responsible for managing interactive logons, logoffs, and system security access. Operating with elevated SYSTEM privileges, Winlogon controls the Secure Attention Sequence (SAS), delegates user authentication, sets up the initial environment, and securely launches the user's configured desktop shell. This article details the specific sequence and mechanisms Winlogon employs to transition a system from a locked, pre-authentication state to an active, secure user session.

Managing the Secure Attention Sequence (SAS)

Winlogon guarantees security by intercepting the hardware-level Secure Attention Sequence—specifically the Ctrl+Alt+Delete key combination. In Windows 2000, user-mode applications cannot intercept or spoof this keystroke. When the SAS is triggered, Winlogon isolates the interface from unauthorized software, ensuring that credential capture happens strictly within a trusted environment.

Coordinating with GINA and LSASS

Winlogon does not collect credentials or validate them directly; instead, it orchestrates the process through specialized modules:

  1. GINA (Graphical Identification and Authentication): Winlogon loads the GINA dynamic-link library (defaulting to msgina.dll). GINA displays the logon dialog, prompts the user for their username, password, and domain, and returns the inputs to Winlogon.
  2. LSASS (Local Security Authority Subsystem Service): Winlogon passes the credentials received from GINA to LSASS. LSASS queries the local Security Accounts Manager (SAM) or the Windows 2000 Active Directory domain controller to authenticate the user and generate a security access token.

Setting Up the User Context

Once LSASS verifies the credentials and returns the security token, Winlogon prepares the operating environment for the incoming user session:

  • Desktop Switching: Windows creates multiple internal desktops. Winlogon switches the active view from the secure "Winlogon desktop" to the "Default desktop" where user-level applications operate.
  • Loading Profiles: Winlogon invokes the User Profile Service to load the user's registry hive (NTUSER.DAT) into HKEY_CURRENT_USER.
  • Setting Quotas and Environment: Winlogon applies assigned user rights, group policies, environment variables, and network drive configurations according to the security token.

Launching the User Shell

With the environment initialized, Winlogon launches the security shell (the primary user interface).

  1. Registry Lookup: Winlogon queries the system registry key:
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
    By default, this entry contains Explorer.exe, though administrators can define custom security shells.
  2. Executing CreateProcessAsUser: Winlogon calls the Windows API function CreateProcessAsUser, passing the security access token generated by LSASS. This executes the shell process inside the restricted security context of the logged-on user rather than Winlogon's elevated SYSTEM privilege level.

Session Monitoring and Lifecycle Control

After launching the shell, Winlogon remains active in the background. It continuously monitors the session to handle events such as screen-saver activation, workstation locking, logoff requests, and system shutdowns, ensuring that any subsequent security transitions return cleanly to the protected Winlogon desktop.