Section 9: User Login and Desktop

The Big Picture: Opening the Front Door

Everything so far happened without you. Now the PC is ready to meet you. This final stage does four things:

1. Shows a sign-in screen and asks who you are.
2. Checks your password, PIN or face.
3. Builds your personal workspace: your settings, your files, your desktop.
4. Starts your programs: the taskbar, and anything set to start with Windows.

In Section 8, smss.exe started winlogon.exe in session 1. That is where we begin.

winlogon.exe ─► LogonUI.exe (screen) ─► lsass.exe (checks) ─► profile loads ─► userinit.exe ─► explorer.exe
    9.1              9.2                    9.3 / 9.4              9.5              9.6           9.6

9.1 Winlogon Process (winlogon.exe)

What it is: winlogon.exe is the Windows Logon program. It is the manager of sign-in and sign-out for the session. Every user session has its own Winlogon.

Its jobs:

• Watch for the Secure Attention Sequence (SAS). That is Ctrl + Alt + Del. Only Windows itself can see this key combination. A fake sign-in screen written by a malicious program cannot catch it. So when you press Ctrl + Alt + Del, you know you are talking to the real Windows. (This is why some company PCs ask you to press it before sign-in.)
• Start the sign-in screen (LogonUI.exe) when needed.
• Hand your credentials to lsass.exe to be checked.
• Load your profile after a successful sign-in.
• Start your shell: the program that gives you the desktop. By default, it starts userinit.exe, which finally starts explorer.exe.
• Handle lock, sign out, shut down. When you press Win + L (lock), Winlogon shows the lock screen again.

Winlogon works on its own private desktop (a separate screen area for windows). Your normal programs run on a different desktop and cannot spy on the sign-in screen.

9.2 Login Prompt Appears

What it is: The sign-in screen is a separate program called LogonUI.exe. Winlogon starts it, and it draws the background picture, the clock, your name and the password box.

LogonUI does not decide anything about passwords. It only collects them. It uses small plug-ins called credential providers: one for password, one for PIN, one for fingerprint or face (Windows Hello), one for a smart card, and so on. Those little plug-ins are what show you the different ways to sign in.

When you press Enter, LogonUI passes the data to Winlogon, which passes it to the LSASS (next topic).

The sign-in screen is the end of the "boot" visible to most people. Yet a lot is still going on behind it: the Automatic (Delayed Start) services (Section 8.3) and more drivers are still starting. Because of this, a PC can feel "ready" before it really is, and be slow for the first minute.

Try this: Wait at the sign-in screen for 30 seconds before typing. Sometimes the first sign-in is faster, because the PC finished its background start-up work.

9.3 LSASS (Local Security Authority)

What it is: lsass.exe is the Local Security Authority Subsystem Service. It is the security office of Windows. It was started during Section 8.2, and it is the part that really decides whether you may enter.

Its jobs:

• Check credentials (Section 9.4).
• Create the access token for a successful sign-in (explained below).
• Enforce security policy: password rules, lockout after failed tries.
• Write security events (like "an account logged on") to the Security log.

LSASS uses authentication packages, small modules for different methods:

Because LSASS holds secrets (it checks passwords and keeps sign-in information in memory), it is a top target for attackers. Windows has extra protections for it. You should never be asked to "install a tool to read LSASS". And lsass.exe should always live in C:\Windows\System32, with only one copy running.

9.4 Authentication

What it is: Authentication means proving who you are. After you type your password, this is what happens inside:

1. Winlogon gives LSASS your user name and password (or PIN, or scan).
2. LSASS never compares plain passwords. It turns your password into a hash (a scrambled, fixed-length fingerprint that cannot be turned back into the password) and compares the hash with the one it has stored.
3. Where it compares:
   • A local account: it looks in the SAM (the hive from Section 6.3).
   • A Microsoft or work account: it may check a cached copy, or ask an online server.
   • A company domain account: it asks a domain controller using Kerberos.
4. If the check passes, LSASS builds an access token.

The access token is like a badge with your name, your group memberships and your privileges (what you are allowed to do). Every program that you start gets a copy of this token. Whenever a program asks for a file or a setting, Windows reads the badge and decides yes or no. This is how Windows keeps your files private from other users.

LSASS records the result in the Security log in Event Viewer: Event ID 4624 for a successful sign-in and 4625 for a failed one. (You may need to run Event Viewer as administrator.)

9.5 User Profile Loading

What it is: Your profile is your personal workspace: your desktop picture, your documents, browser settings and app settings. It is stored in C:\Users\YourName.

After the token is made, the User Profile Service (ProfSvc) loads the profile:

1. Finds your profile folder C:\Users\YourName. If it is your first sign-in, Windows creates it, copying a template from the Default user profile. (This is the "Hi... We're setting things up for you" screen on a new account.)
2. Loads your registry hive, the file NTUSER.DAT, into the registry as HKEY_CURRENT_USER (HKCU). Now all your personal settings are available.
3. Applies Group Policy, if the PC is on a company domain. Group Policy is a set of rules from the administrator, such as a fixed wallpaper or blocked settings.
4. Sets your environment: variables like %USERPROFILE%, drive mappings, printers.
5. Connects network drives and cloud folders (like OneDrive) as needed.

A big or damaged profile makes sign-in slow or fails it. If Windows says "We can't sign in to your account", the profile may be corrupt.

C:\Users\YourName\
 ├─ Desktop, Documents, Downloads, ...    ← your files
 ├─ AppData\                               ← settings of your programs (hidden folder)
 └─ NTUSER.DAT                             ← your registry hive (becomes HKEY_CURRENT_USER)

Windows tip: You can see your profile folder by typing %USERPROFILE% into File Explorer's address bar.

9.6 Explorer.exe and Desktop

What it is: explorer.exe is the program that is the Windows desktop. It draws the taskbar, the Start menu, the desktop icons and the File Explorer windows. It is the shell (the program that gives you the main way to use the PC).

How it starts:

1. Winlogon starts userinit.exe, as listed in the registry (the Userinit value).
2. userinit.exe does some quick set-up work: it runs sign-in scripts if any exist.
3. It then starts the shell, listed in the registry's Shell value. By default that is explorer.exe.
4. userinit.exe then ends. That is why explorer.exe has no visible "parent" in Task Manager's tree: the parent has already quit.
5. explorer.exe draws the desktop, the taskbar and the notification icons.
6. A desktop manager (dwm.exe) is running, composing all windows into the final picture. (Windows draws every window to its own area, and DWM combines them with effects like transparency.)

Test it: In Task Manager, select Windows Explorer → right-click → Restart. The taskbar disappears and comes back. You just restarted the shell without restarting Windows.

At this point you see your desktop. But Windows is not quite done: your startup applications (next topic) are starting.

9.7 Startup Applications

What it is: Startup applications are programs that start by themselves when you sign in: chat apps, cloud storage, update helpers, drivers' tray icons. They add to the time before your PC feels ready. Each one competes for the disk, CPU and memory.

Where do they come from? Windows has several places where a program can ask to be started:

Windows intentionally waits a short time (around ten seconds is typical) after the desktop appears before it starts the startup apps. This lets the desktop become responsive first.

How to see and manage them (safe):

1. Open Task Manager (Ctrl + Shift + Esc).
2. Choose the Startup apps tab (called Startup in older Windows).
3. Look at the Status (Enabled or Disabled) and Startup impact (Low, Medium, High). The top-right shows Last BIOS time, the time the firmware took (on UEFI PCs).
4. Right-click an item and choose Disable to stop it starting. This does not remove the program. You can turn it on again.

You can also list them in PowerShell:

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location

Rule of thumb: If you disable something and a function stops working, turn it back on. Nothing here is permanent.

Summary