Section 8: What Happens When You Enter Your Windows Password (Complete Chain)

The Big Picture: From Keystroke to Desktop

You press a key, type a password, press Enter, and a second later your desktop appears. It feels like one step. Under the hood, about ten parts of Windows pass your request along, like runners in a relay race. Each runner does one job and hands the baton to the next.

This section ties together everything in Chapter 24: accounts (Section 1), tokens (Section 3), SIDs (Section 4), protocols (Section 6) and credentials (Section 7).

Here is the whole chain on one page:

┌──────────────────────────────────────────────────────────────────┐
│ 1. KEYBOARD  (interrupt, then the keyboard driver)               │
│    Keystrokes travel through the kernel input path               │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 2. WINLOGON.EXE  (Secure Attention Sequence: Ctrl+Alt+Del)       │
│    Switches to the secure sign-in desktop                        │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 3. LOGONUI.EXE  (draws the sign-in screen)                       │
│    Loads the credential providers: password, PIN, Hello, card    │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 4. CREDENTIAL PROVIDER  (packages what you typed)                │
│    Hands the credentials back to Winlogon                        │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 5. LSASS.EXE  (Local Security Authority) receives them           │
│    Chooses an authentication package                             │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 6. AUTHENTICATION PACKAGE                                        │
│    MSV1_0 (local / NTLM)   or   Kerberos (domain)                │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 7. ACCOUNT DATABASE                                              │
│    Local: SAM (hashes)   or   Domain: domain controller (AD)     │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 8. LSASS BUILDS: logon session + ACCESS TOKEN                    │
│    user SID, group SIDs, privileges, integrity level             │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 9. WINLOGON starts USERINIT.EXE with that token                  │
│    userinit sets up your profile, then starts the shell          │
└──────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
┌──────────────────────────────────────────────────────────────────┐
│ 10. EXPLORER.EXE = your desktop, running with your token         │
│    Every program you start gets a copy of the token              │
└──────────────────────────────────────────────────────────────────┘

Now let us walk through it, step by step.

8.1 Winlogon Captures Input (Secure Attention Sequence)

What it is: Winlogon (winlogon.exe) is the Windows program that manages sign-in and sign-out. It runs as SYSTEM, from the moment the PC boots, and it owns a separate, protected desktop just for sign-in.

Before you type anything:

1. The keyboard sends an interrupt (Chapter 4). The keyboard driver reads the key and passes it up through the kernel.
2. On a PC set to require it, you press Ctrl + Alt + Del. This special key combination is called the Secure Attention Sequence (SAS).
3. Windows treats the SAS as a direct line to Winlogon. No normal program can intercept or fake it.

Why a special key combination? Imagine a thief puts a fake sign-in screen on top of the real one, to steal your password. The SAS defeats this: when you press Ctrl+Alt+Del, Windows itself (not any app) answers and shows the real screen on the protected desktop. A program cannot draw on that desktop.

Hedge: home PCs usually skip the SAS requirement and go straight to the sign-in screen. Company PCs often require it. The protected desktop is used in both cases.

LogonUI and credential providers. Winlogon does not draw the screen itself. It starts LogonUI (LogonUI.exe), a helper that draws the sign-in screen and loads the credential providers.

A credential provider is a small plug-in that offers one way to sign in and collects the proof:

The icons you see under "Sign-in options" are exactly these providers. When you type, the provider packages the credentials and gives them back to Winlogon.

Windows tip: You can see winlogon.exe (and LogonUI.exe while the sign-in screen shows) in Task Manager → Details. Winlogon always runs with user name SYSTEM.

8.2 LSASS Receives Credentials

What it is: Winlogon does not check your password. It forwards the credentials, by an internal call, to LSASS (lsass.exe). LSASS is the Local Security Authority Subsystem Service, the central "security office" of Windows.

LSASS has many jobs:

Why is LSASS so important (and protected)? It holds the facts that prove identity for signed-in users. For this reason Windows protects it heavily: it runs as SYSTEM, and recent Windows versions can run it as a protected process (a process that even administrators cannot freely inspect) and with extra isolation features. Hedge: which protections are on depends on your Windows version and settings.

A sign you must never ignore: lsass.exe should exist once, in C:\Windows\System32, run as SYSTEM. A second copy, a different folder, or a similar-looking name such as lsas.exe is a warning sign worth investigating with your antivirus.

8.3 Authentication Package Validates (Local SAM or Domain Controller)

What it is: LSASS now hands the credentials to the right authentication package (Section 6) and waits for a yes or no.

The local-account check in simple words:

 LSASS ──► MSV1_0 ──► hashes what you typed
                          │
                          ▼
              compare with the stored hash in the SAM
                 (HKLM\SAM, protected, hashes only)
                          │
                 match ───┴─── no match
                   │               │
              "valid user"   "wrong password" (login fails)

The domain check in simple words: your PC contacts the domain controller, using Kerberos. It proves you know the password, and receives a TGT (Section 6.2). If the PC cannot reach the DC (for example you are on a laptop away from the office), Windows may allow a sign-in using a cached copy of your earlier successful sign-in, so laptops still work offline.

If the check fails: LSASS reports the failure to Winlogon, which shows an error such as "The password is incorrect." LSASS also writes an audit event (see below). Windows may also count failed attempts, and some accounts lock out after too many wrong guesses (a safety feature set by policy).

Windows tip (needs administrator rights, hedge: depends on audit settings): In Event Viewer → Windows Logs → Security, sign-in success is event 4624 and failure is event 4625. Reading these is a good way to see sign-ins on your own PC.

8.4 Access Token Generated

What it is: If the check succeeds, LSASS creates the user's identity for this session, as described in Section 3.2.

LSASS:

1. Looks up your user SID and all group SIDs (local groups, and domain groups if any).
2. Adds the privileges your account is granted.
3. Sets the integrity level (Medium for standard users; administrators get a filtered Medium token, plus a linked full token for UAC).
4. Creates a logon session with a unique ID.
5. Creates the access token tied to that session.
6. Returns the token to Winlogon.

 success ──► LSASS collects:  SID + groups + privileges + integrity
                  │
                  ▼
        [ LOGON SESSION ]──►[ ACCESS TOKEN ]──► back to Winlogon

Remember (Section 3.2): the token is a snapshot. Group changes made later do not appear until your next sign-in.

8.5 Explorer.exe Launched with That Token

What it is: With the token in hand, Winlogon builds your desktop.

1. Winlogon loads your user profile (your settings and files from C:\Users\<you>, and your own part of the registry, called HKEY_CURRENT_USER).
2. It starts userinit.exe, a short-lived program that runs logon scripts and policy items, then starts the shell.
3. The shell is explorer.exe. It draws the taskbar, Start menu and desktop icons.
4. userinit.exe then exits, which is why you see explorer.exe sitting with no visible parent in Task Manager.

The vital point: explorer.exe runs with your token. In Task Manager's Details tab, the User name column for explorer.exe shows you, not SYSTEM.

 Winlogon (SYSTEM) ──► userinit.exe (your token) ──► explorer.exe (your token)
                              │
                              └─ exits after starting the shell

Services, by contrast, start earlier in the boot, belong to other logon sessions (SYSTEM, LOCAL SERVICE and so on), and do not wait for you to sign in.

8.6 Every Subsequent Process Inherits or Derives from That Token

What it is: From now on, everything you start is a child of something that has your token.

 explorer.exe (your token)
   ├─ chrome.exe     (a copy of your token; its tabs get RESTRICTED copies)
   ├─ notepad.exe    (a copy of your token)
   └─ cmd.exe        (a copy of your token)
         └─ ping.exe (a copy again)

Rules to remember:

The full story in a sentence: You prove who you are once; Winlogon, LogonUI and LSASS check it; LSASS builds a token; and every program you run carries that token, so Windows can quickly decide what each program may touch.

Sign out and what happens: When you sign out, Winlogon ends your processes, LSASS closes the logon session, and the token is discarded. The next sign-in creates a fresh, new one.

Lock vs sign out vs switch user:

Summary