How Winlogon Handled SAS in Windows XP

In Windows XP, the Windows Logon process (winlogon.exe) served as the core user authentication manager, primarily relying on the Secure Attention Sequence (SAS)—the Ctrl+Alt+Del keystroke combination—to guarantee secure user interaction. By coordinating directly with the kernel-mode driver win32k.sys, switching to an isolated desktop, and delegating UI rendering to the Graphical Identification and Authentication (GINA) library, winlogon.exe ensured that credential entry remained protected from malicious software and keylogging attempts.

Exclusive Registration of the SAS Hotkey

When Windows XP booted, winlogon.exe initialized as a privileged system process running under the NT AUTHORITY\SYSTEM account. During startup, it communicated directly with the Windows subsystem kernel driver (win32k.sys) to register the Ctrl+Alt+Del key combination as the system's reserved Secure Attention Sequence.

Because this registration took place at the kernel level, standard user-mode applications could not intercept, override, or spoof the Ctrl+Alt+Del keystroke. If a regular process attempted to hook the keyboard or listen for this specific combination, the kernel bypassed those hooks entirely and routed the hardware event directly to winlogon.exe.

Secure Desktop Switching

Upon receiving the SAS notification from win32k.sys, winlogon.exe took immediate control of the display subsystem to isolate user input:

  1. Suspending the Default Desktop: The interactive user session (running on the "Default" desktop) was frozen, preventing active background applications from capturing input or drawing on the screen.
  2. Switching to the Winlogon Desktop: winlogon.exe instructed the window manager to switch the active display to the protected "Winlogon" desktop.

Because standard user-mode processes lacked permissions to interact with or inject threads into the Winlogon desktop, credential harvesting tools could not manipulate or monitor the login interface.

Delegation to the GINA Subsystem

Rather than displaying the logon and security dialogs directly, winlogon.exe in Windows XP delegated visual interface tasks and policy execution to the Graphical Identification and Authentication (GINA) architecture, represented by the default msgina.dll.

  • Context Evaluation: When the SAS occurred, winlogon.exe evaluated the current session state (e.g., logged off, logged on, or workstation locked) and called the appropriate GINA export function, such as WlxLoggedOnSAS or WlxLoggedOutSAS.
  • Interface Presentation: msgina.dll rendered the necessary interface—whether the logon prompt, the Windows Security dialog (featuring options to Lock, Log Off, Shut Down, or launch Task Manager), or the unlock credential dialog.
  • Authentication Handoff: Once the user entered their username and password, GINA handed the credentials back to winlogon.exe, which forwarded them to the Local Security Authority Subsystem Service (lsass.exe) for validation.

Defense Against Credential Spoofing

The primary objective of this architecture was to defeat phishing mechanisms. In Windows XP, third-party software could easily display a full-screen window imitating the Windows login screen. By requiring the user to press Ctrl+Alt+Del to trigger the prompt, the operating system guaranteed that control was handed over to trusted code running on the secure desktop, rendering visual spoofing attacks ineffective.