2320:
42:
2331:
188:
Winlogon sets the protection of the window station and corresponding desktops to ensure that each is properly accessible. In general, this means that the local system will have full access to these objects and that an interactively logged-on user will have read access to the window station object and
268:
Multiple networks installed on a
Windows system can be included in the authentication process and in password-updating operations. This inclusion lets additional networks gather identification and authentication information all at once during normal logon, using the secure desktop of Winlogon. Some
260:
workstation as locked. When there is mouse or keyboard activity, Winlogon invokes the WlxDisplayLockedNotice function of the GINA and locked workstation behavior resumes. If the screen saver is not secure, any keyboard or mouse activity terminates the screen saver without notification to the GINA.
250:
When a user logs on, the GINA is responsible for creating one or more initial processes for that user. Winlogon provides a support function for the GINA to apply the security of the newly logged-on user to these processes. However, the preferred way to do this is for the GINA to call the
Windows
259:
Winlogon monitors keyboard and mouse activity to determine when to activate screen savers. After the screen saver is activated, Winlogon continues to monitor keyboard and mouse activity to determine when to terminate the screen saver. If the screen saver is marked as secure, Winlogon treats the
282:
Winlogon is a common target for several threats that could modify its function and memory usage. Winlogon has support for plugins that get loaded and notified about specific events. Some rootkits bundle
Winlogon plugins because they are loaded before any user logs in. Some registry keys allow
241:
When users log on, their user profiles are loaded into the registry. In this way, the processes of the user can use the special registry key HKEY_CURRENT_USER. Winlogon does this automatically after a successful logon but before activation of the shell for the newly logged-on
619:
31:
232:
When
Winlogon encounters a SAS event or when a SAS is delivered to Winlogon by the GINA, Winlogon sets the state accordingly, changes to the Winlogon desktop, and calls one of the SAS processing functions of the
599:
297:
1335:
1350:
270:
209:
205:
127:
126:
The first part of the logon process
Winlogon conducts is starting the process that shows the user the logon screen. Before Windows Vista this was done by
1515:
592:
131:
116:
1172:
2206:
585:
2335:
608:
292:
2361:
1585:
1225:
809:
644:
1757:
1666:
1182:
814:
454:
374:
130:, but starting with Vista this is done by LogonUI. These programs are responsible for getting user credential and passing them to the
157:
desktop when the shell indicates that it is ready to display something for the user, or after thirty seconds, whichever comes first.
1505:
1485:
1448:
1410:
1395:
318:
in
September 2020, Winlogon was the only piece missing from the source code, rendering the leaked operating system incomplete.
2251:
1833:
1360:
82:
is running (requiring another authentication step). The roles and responsibilities of
Winlogon have changed significantly in
337:
283:
multiple values to be supplied that allow a malicious program to be executed at the same time as a legitimate system file.
1375:
105:
95:
2216:
2085:
1772:
1762:
1636:
1540:
1400:
757:
712:
471:
2356:
2324:
1692:
1651:
1550:
1405:
1202:
917:
867:
419:
390:
520:
1914:
1794:
1500:
999:
639:
632:
627:
496:"Boot or Logon Autostart Execution: Winlogon Helper DLL, Sub-technique T1547.004 - Enterprise | MITRE ATT&CK®"
2246:
2211:
1641:
1631:
1570:
1480:
1370:
1340:
989:
687:
201:
101:
71:
1611:
1555:
1535:
1380:
1149:
1034:
924:
2196:
2191:
2035:
2030:
1990:
1950:
1900:
1646:
1390:
1385:
1260:
1235:
1197:
1167:
1117:
929:
852:
777:
697:
672:
112:
2176:
2140:
1752:
1737:
1495:
1453:
1345:
1275:
1192:
1177:
772:
2305:
2125:
2070:
2010:
1995:
1804:
1475:
1430:
1287:
1240:
2290:
2285:
2130:
2100:
2065:
1955:
1661:
1656:
1560:
1510:
1468:
1438:
1325:
912:
877:
824:
762:
568:
169:
75:
2231:
2090:
2045:
2020:
1975:
1921:
1720:
1575:
1458:
907:
892:
832:
752:
722:
572:
172:
prompt is shown. Winlogon now starts the program specified in the
Userinit value which defaults to
565:
Windows Vista and
Windows Server 2008: Understanding, Enhancing and Extending Security End-to-end
2236:
2186:
1960:
1879:
1865:
1784:
1490:
1330:
1297:
1270:
1265:
939:
842:
837:
737:
198:
165:
224:
SAS as one of the SASs it recognizes should use the
Winlogon support provided for this purpose.
49:
2300:
2226:
2181:
2080:
2075:
2050:
2005:
1970:
1840:
1144:
954:
787:
450:
370:
64:
564:
137:
After control is given back to Winlogon, it creates and opens an interactive window station,
2241:
2150:
1985:
1928:
1886:
1747:
1715:
1671:
1626:
1545:
1305:
1102:
979:
969:
732:
727:
67:
2277:
2160:
2135:
2120:
2110:
2060:
2055:
1809:
1443:
1159:
1024:
1014:
959:
944:
802:
692:
366:
553:
547:
1767:
1310:
1122:
1112:
1097:
1029:
897:
872:
847:
797:
767:
677:
2350:
2256:
2115:
2015:
1355:
1315:
1092:
1067:
1059:
994:
862:
662:
83:
41:
2025:
1980:
1907:
1872:
1580:
1530:
1320:
1072:
1019:
984:
902:
882:
702:
682:
571:
presentation that includes information on changes to Winlogon in Windows Vista and
308:
495:
2095:
2040:
1945:
1799:
1687:
1565:
1420:
1212:
1187:
782:
208:/credential providers to use as their SAS, or as part of their SAS. In general,
79:
577:
119:, but since Vista these have been launched by the Windows Startup Application (
2000:
1824:
1365:
1255:
1129:
1049:
974:
792:
315:
45:
35:
1621:
1616:
1250:
1139:
1087:
857:
17:
559:
197:
Winlogon has special hooks into the User32 server that allow it to monitor
212:
should monitor SASs on their own; however, any GINA that has the standard
2201:
2105:
1965:
1725:
1220:
1077:
964:
949:
887:
747:
707:
74:, loading the user profile on logon, creates the desktops for the window
2221:
2155:
1893:
1779:
1742:
1730:
1415:
1134:
1107:
1082:
1044:
742:
667:
2295:
2145:
1814:
1595:
1520:
251:
function CreateProcessAsUser, and let the system provide the service.
204:(SAS) events. Winlogon makes this SAS event information available to
30:
2261:
1697:
1525:
1230:
1004:
717:
302:
40:
29:
338:"Windows Administration: Inside the Windows Vista Kernel: Part 2"
269:
of the parameters required in the Winlogon services available to
1789:
1463:
1282:
1245:
111:
Before Windows Vista, Winlogon was responsible for starting the
581:
1707:
1039:
1009:
934:
449:(6th ed.). Redmond, Wash.: Microsoft Press. p. 77.
445:
Ionescu, Alex; Russinovich, Mark; Solomon, David A. (2012).
560:
MSKB:193361 MSGINA.DLL does not Reset WINLOGON Structure
273:
explicitly support these additional network providers.
153:. Winlogon switches from the Winlogon desktop to the
298:
Architecture of the Windows NT operating system line
2274:
2169:
1938:
1857:
1850:
1823:
1706:
1680:
1604:
1429:
1296:
1211:
1158:
1058:
823:
653:
96:
Booting process of Windows NT § Authentication
27:Component of Microsoft Windows operating systems
305:, a trojan that attaches itself to winlogon.exe
556:, Developer tutorial for writing a custom GINA
550:, Developer tutorial for writing a custom GINA
189:full access to the application desktop object.
593:
361:Russinvoich, Mark E.; Solomon, David (2005).
78:, and optionally locking the computer when a
8:
176:. This value supports multiple executables.
472:"Winlogon Notification Events - Win32 apps"
2330:
1854:
600:
586:
578:
132:Local Security Authority Subsystem Service
117:Local Security Authority Subsystem Service
221:
217:
213:
328:
2207:Next-Generation Secure Computing Base
521:"Windows XP source code leaks online"
365:(4th ed.). Redmond, Washington:
185:Window station and desktop protection
70:that is responsible for handling the
48:lock screen, requiring user to press
7:
414:
412:
293:List of Microsoft Windows components
247:Assignment of security to user shell
34:Classic "Begin logon" dialog box on
1336:Distributed Transaction Coordinator
1667:User Interface Privilege Isolation
25:
265:Multiple network provider support
2329:
2319:
2318:
160:The system switches back to the
134:, which authenticates the user.
1396:Remote Differential Compression
2252:Windows System Assessment Tool
141:, and creates three desktops,
1:
106:booting process of Windows NT
86:and later operating systems.
1541:Open XML Paper Specification
1401:Remote Installation Services
609:Microsoft Windows components
164:desktop if the user presses
100:Winlogon is launched by the
1693:Windows Subsystem for Linux
1652:Mandatory Integrity Control
1406:Windows Deployment Services
1203:Wireless Zero Configuration
363:Microsoft Windows Internals
316:Windows XP Source code leak
311:, a similar process in UNIX
2378:
2362:Computer security software
1795:Universal Windows Platform
1501:Kernel Transaction Manager
1486:Hardware Abstraction Layer
1183:Multimedia Class Scheduler
519:Warren, Tom (2020-09-25).
93:
2314:
2247:Windows Services for UNIX
1632:Data Execution Prevention
1481:Graphics Device Interface
1371:Network Access Protection
990:Remote Desktop Connection
615:
554:Customizing GINA - Part 2
548:Customizing GINA - Part 1
447:Windows internals, Part 1
202:secure attention sequence
102:Session Manager Subsystem
72:secure attention sequence
1612:Security and Maintenance
1556:Security Account Manager
1150:Windows XP visual styles
194:Standard SAS recognition
2197:Media Control Interface
2031:Help and Support Center
1647:Kernel Patch Protection
1411:System Resource Manager
1391:Remote Desktop Services
1386:Print Services for UNIX
1168:Service Control Manager
778:Windows Error Reporting
698:DirectX Diagnostic Tool
426:. Microsoft Corporation
397:. Microsoft Corporation
229:SAS routine dispatching
113:Service Control Manager
2177:Desktop Cleanup Wizard
1753:COM Structured storage
1454:Desktop Window Manager
1346:Windows Media Services
63:) is the component of
53:
38:
1805:Windows Mixed Reality
1476:Enhanced Write Filter
1326:Roaming user profiles
94:Further information:
44:
33:
2086:Mobile Device Center
2036:Health & Fitness
1834:Solitaire Collection
1662:User Account Control
1657:Protected Media Path
1561:Server Message Block
1511:Logical Disk Manager
763:System Policy Editor
748:System Configuration
569:Microsoft PowerPoint
256:Screen saver control
238:User profile loading
170:User Account Control
2232:Virtual DOS machine
1576:System Idle Process
1551:Resource Protection
1459:Portable Executable
1351:Active DRM Services
753:System File Checker
723:Performance Monitor
573:Windows Server 2008
476:learn.microsoft.com
342:learn.microsoft.com
2357:Windows components
2237:Windows on Windows
1961:Backup and Restore
1773:Transaction Server
1491:I/O request packet
1331:Folder redirection
1000:Speech Recognition
758:System Information
713:Management Console
199:Control-Alt-Delete
166:Control-Alt-Delete
54:
39:
2344:
2343:
2270:
2269:
2227:Video for Windows
2182:Games for Windows
2051:Internet Explorer
1145:Windows Spotlight
788:Windows Installer
391:"Window Stations"
104:as a part of the
68:operating systems
65:Microsoft Windows
16:(Redirected from
2369:
2333:
2332:
2322:
2321:
2242:Windows SideShow
2021:Food & Drink
1915:Spider Solitaire
1855:
1748:ActiveX Document
1716:Active Scripting
1672:Windows Firewall
1627:Credential Guard
1306:Active Directory
1103:Indexing Service
733:Resource Monitor
728:Recovery Console
602:
595:
588:
579:
535:
534:
532:
531:
516:
510:
509:
507:
506:
500:attack.mitre.org
492:
486:
485:
483:
482:
467:
461:
460:
442:
436:
435:
433:
431:
416:
407:
406:
404:
402:
387:
381:
380:
358:
352:
351:
349:
348:
333:
180:Responsibilities
175:
163:
156:
152:
148:
144:
140:
122:
21:
2377:
2376:
2372:
2371:
2370:
2368:
2367:
2366:
2347:
2346:
2345:
2340:
2310:
2278:Microsoft Store
2276:
2266:
2212:POSIX subsystem
2192:File Protection
2165:
2136:Program Manager
2121:Phone Companion
2111:Outlook Express
2061:Make Compatible
1991:Desktop Gadgets
1951:Anytime Upgrade
1934:
1846:
1819:
1810:Windows Runtime
1702:
1676:
1642:Family features
1600:
1425:
1381:DFS Replication
1292:
1207:
1198:Error Reporting
1154:
1054:
930:Mobility Center
925:Movies & TV
819:
803:Windows Insider
693:Driver Verifier
688:Drive Optimizer
655:
649:
640:Booting process
611:
606:
544:
539:
538:
529:
527:
518:
517:
513:
504:
502:
494:
493:
489:
480:
478:
470:alvinashcraft.
469:
468:
464:
457:
444:
443:
439:
429:
427:
418:
417:
410:
400:
398:
389:
388:
384:
377:
367:Microsoft Press
360:
359:
355:
346:
344:
335:
334:
330:
325:
289:
280:
278:Vulnerabilities
223:
219:
215:
182:
173:
161:
154:
150:
146:
142:
138:
120:
98:
92:
50:Ctrl+Alt+Delete
28:
23:
22:
15:
12:
11:
5:
2375:
2373:
2365:
2364:
2359:
2349:
2348:
2342:
2341:
2339:
2338:
2327:
2315:
2312:
2311:
2309:
2308:
2303:
2298:
2293:
2288:
2282:
2280:
2272:
2271:
2268:
2267:
2265:
2264:
2259:
2254:
2249:
2244:
2239:
2234:
2229:
2224:
2219:
2214:
2209:
2204:
2199:
2194:
2189:
2184:
2179:
2173:
2171:
2167:
2166:
2164:
2163:
2158:
2153:
2148:
2143:
2141:Steps Recorder
2138:
2133:
2128:
2123:
2118:
2113:
2108:
2103:
2098:
2093:
2088:
2083:
2078:
2073:
2068:
2063:
2058:
2053:
2048:
2043:
2038:
2033:
2028:
2023:
2018:
2013:
2008:
2003:
1998:
1993:
1988:
1983:
1978:
1973:
1968:
1963:
1958:
1953:
1948:
1942:
1940:
1936:
1935:
1933:
1932:
1925:
1918:
1911:
1904:
1897:
1890:
1883:
1876:
1869:
1861:
1859:
1852:
1848:
1847:
1845:
1844:
1837:
1829:
1827:
1821:
1820:
1818:
1817:
1812:
1807:
1802:
1797:
1792:
1787:
1782:
1777:
1776:
1775:
1770:
1768:OLE Automation
1765:
1760:
1755:
1750:
1745:
1735:
1734:
1733:
1728:
1723:
1712:
1710:
1704:
1703:
1701:
1700:
1695:
1690:
1684:
1682:
1678:
1677:
1675:
1674:
1669:
1664:
1659:
1654:
1649:
1644:
1639:
1634:
1629:
1624:
1619:
1614:
1608:
1606:
1602:
1601:
1599:
1598:
1593:
1588:
1583:
1578:
1573:
1568:
1563:
1558:
1553:
1548:
1543:
1538:
1536:Object Manager
1533:
1528:
1523:
1518:
1513:
1508:
1503:
1498:
1496:Imaging Format
1493:
1488:
1483:
1478:
1473:
1472:
1471:
1466:
1456:
1451:
1446:
1441:
1435:
1433:
1427:
1426:
1424:
1423:
1418:
1413:
1408:
1403:
1398:
1393:
1388:
1383:
1378:
1373:
1368:
1363:
1358:
1353:
1348:
1343:
1338:
1333:
1328:
1323:
1318:
1313:
1308:
1302:
1300:
1294:
1293:
1291:
1290:
1285:
1280:
1279:
1278:
1273:
1268:
1263:
1258:
1253:
1243:
1238:
1233:
1228:
1223:
1217:
1215:
1209:
1208:
1206:
1205:
1200:
1195:
1193:Task Scheduler
1190:
1185:
1180:
1175:
1170:
1164:
1162:
1156:
1155:
1153:
1152:
1147:
1142:
1137:
1132:
1127:
1126:
1125:
1123:Special folder
1120:
1115:
1110:
1105:
1095:
1090:
1085:
1080:
1075:
1070:
1064:
1062:
1056:
1055:
1053:
1052:
1047:
1042:
1037:
1035:Voice Recorder
1032:
1027:
1022:
1017:
1012:
1007:
1002:
997:
992:
987:
982:
977:
972:
967:
962:
957:
952:
947:
942:
937:
932:
927:
922:
921:
920:
910:
905:
900:
895:
890:
885:
880:
875:
870:
865:
860:
855:
850:
845:
840:
835:
829:
827:
821:
820:
818:
817:
812:
807:
806:
805:
798:Windows Update
795:
790:
785:
780:
775:
770:
768:System Restore
765:
760:
755:
750:
745:
740:
735:
730:
725:
720:
715:
710:
705:
700:
695:
690:
685:
680:
678:Device Manager
675:
670:
668:Command Prompt
665:
659:
657:
651:
650:
648:
647:
642:
637:
636:
635:
630:
622:
616:
613:
612:
607:
605:
604:
597:
590:
582:
576:
575:
562:
557:
551:
543:
542:External links
540:
537:
536:
511:
487:
462:
456:978-0735648739
455:
437:
408:
382:
376:978-0735619173
375:
369:. p. 81.
353:
336:Archiveddocs.
327:
326:
324:
321:
320:
319:
312:
306:
300:
295:
288:
285:
279:
276:
275:
274:
266:
262:
261:
257:
253:
252:
248:
244:
243:
239:
235:
234:
230:
226:
225:
195:
191:
190:
186:
181:
178:
91:
88:
26:
24:
14:
13:
10:
9:
6:
4:
3:
2:
2374:
2363:
2360:
2358:
2355:
2354:
2352:
2337:
2328:
2326:
2317:
2316:
2313:
2307:
2304:
2302:
2299:
2297:
2294:
2292:
2289:
2287:
2284:
2283:
2281:
2279:
2273:
2263:
2260:
2258:
2257:Windows To Go
2255:
2253:
2250:
2248:
2245:
2243:
2240:
2238:
2235:
2233:
2230:
2228:
2225:
2223:
2220:
2218:
2215:
2213:
2210:
2208:
2205:
2203:
2200:
2198:
2195:
2193:
2190:
2188:
2185:
2183:
2180:
2178:
2175:
2174:
2172:
2168:
2162:
2159:
2157:
2154:
2152:
2149:
2147:
2144:
2142:
2139:
2137:
2134:
2132:
2129:
2127:
2126:Photo Gallery
2124:
2122:
2119:
2117:
2114:
2112:
2109:
2107:
2104:
2102:
2099:
2097:
2094:
2092:
2089:
2087:
2084:
2082:
2079:
2077:
2074:
2072:
2071:Meeting Space
2069:
2067:
2064:
2062:
2059:
2057:
2054:
2052:
2049:
2047:
2044:
2042:
2041:HyperTerminal
2039:
2037:
2034:
2032:
2029:
2027:
2024:
2022:
2019:
2017:
2014:
2012:
2011:Easy Transfer
2009:
2007:
2004:
2002:
1999:
1997:
1994:
1992:
1989:
1987:
1984:
1982:
1979:
1977:
1974:
1972:
1969:
1967:
1964:
1962:
1959:
1957:
1954:
1952:
1949:
1947:
1944:
1943:
1941:
1937:
1931:
1930:
1926:
1924:
1923:
1919:
1917:
1916:
1912:
1910:
1909:
1905:
1903:
1902:
1898:
1896:
1895:
1891:
1889:
1888:
1884:
1882:
1881:
1877:
1875:
1874:
1870:
1868:
1867:
1863:
1862:
1860:
1856:
1853:
1849:
1843:
1842:
1838:
1836:
1835:
1831:
1830:
1828:
1826:
1822:
1816:
1813:
1811:
1808:
1806:
1803:
1801:
1798:
1796:
1793:
1791:
1788:
1786:
1783:
1781:
1778:
1774:
1771:
1769:
1766:
1764:
1761:
1759:
1756:
1754:
1751:
1749:
1746:
1744:
1741:
1740:
1739:
1736:
1732:
1729:
1727:
1724:
1722:
1719:
1718:
1717:
1714:
1713:
1711:
1709:
1705:
1699:
1696:
1694:
1691:
1689:
1686:
1685:
1683:
1681:Compatibility
1679:
1673:
1670:
1668:
1665:
1663:
1660:
1658:
1655:
1653:
1650:
1648:
1645:
1643:
1640:
1638:
1635:
1633:
1630:
1628:
1625:
1623:
1620:
1618:
1615:
1613:
1610:
1609:
1607:
1603:
1597:
1594:
1592:
1589:
1587:
1584:
1582:
1579:
1577:
1574:
1572:
1569:
1567:
1564:
1562:
1559:
1557:
1554:
1552:
1549:
1547:
1544:
1542:
1539:
1537:
1534:
1532:
1529:
1527:
1524:
1522:
1519:
1517:
1514:
1512:
1509:
1507:
1506:Library files
1504:
1502:
1499:
1497:
1494:
1492:
1489:
1487:
1484:
1482:
1479:
1477:
1474:
1470:
1467:
1465:
1462:
1461:
1460:
1457:
1455:
1452:
1450:
1447:
1445:
1442:
1440:
1437:
1436:
1434:
1432:
1428:
1422:
1419:
1417:
1414:
1412:
1409:
1407:
1404:
1402:
1399:
1397:
1394:
1392:
1389:
1387:
1384:
1382:
1379:
1377:
1374:
1372:
1369:
1367:
1364:
1362:
1359:
1357:
1354:
1352:
1349:
1347:
1344:
1342:
1339:
1337:
1334:
1332:
1329:
1327:
1324:
1322:
1319:
1317:
1314:
1312:
1309:
1307:
1304:
1303:
1301:
1299:
1295:
1289:
1286:
1284:
1281:
1277:
1274:
1272:
1269:
1267:
1266:Reparse point
1264:
1262:
1259:
1257:
1254:
1252:
1249:
1248:
1247:
1244:
1242:
1239:
1237:
1234:
1232:
1229:
1227:
1224:
1222:
1219:
1218:
1216:
1214:
1210:
1204:
1201:
1199:
1196:
1194:
1191:
1189:
1186:
1184:
1181:
1179:
1176:
1174:
1171:
1169:
1166:
1165:
1163:
1161:
1157:
1151:
1148:
1146:
1143:
1141:
1138:
1136:
1133:
1131:
1128:
1124:
1121:
1119:
1116:
1114:
1111:
1109:
1106:
1104:
1101:
1100:
1099:
1096:
1094:
1091:
1089:
1086:
1084:
1081:
1079:
1076:
1074:
1071:
1069:
1068:Action Center
1066:
1065:
1063:
1061:
1057:
1051:
1048:
1046:
1043:
1041:
1038:
1036:
1033:
1031:
1028:
1026:
1023:
1021:
1018:
1016:
1013:
1011:
1008:
1006:
1003:
1001:
998:
996:
995:Snipping Tool
993:
991:
988:
986:
983:
981:
978:
976:
973:
971:
968:
966:
963:
961:
958:
956:
953:
951:
948:
946:
943:
941:
938:
936:
933:
931:
928:
926:
923:
919:
916:
915:
914:
911:
909:
906:
904:
901:
899:
896:
894:
891:
889:
886:
884:
881:
879:
876:
874:
871:
869:
866:
864:
861:
859:
856:
854:
853:Character Map
851:
849:
846:
844:
841:
839:
836:
834:
831:
830:
828:
826:
822:
816:
813:
811:
808:
804:
801:
800:
799:
796:
794:
791:
789:
786:
784:
781:
779:
776:
774:
771:
769:
766:
764:
761:
759:
756:
754:
751:
749:
746:
744:
741:
739:
736:
734:
731:
729:
726:
724:
721:
719:
716:
714:
711:
709:
706:
704:
701:
699:
696:
694:
691:
689:
686:
684:
681:
679:
676:
674:
673:Control Panel
671:
669:
666:
664:
663:App Installer
661:
660:
658:
652:
646:
643:
641:
638:
634:
631:
629:
626:
625:
624:Architecture
623:
621:
618:
617:
614:
610:
603:
598:
596:
591:
589:
584:
583:
580:
574:
570:
566:
563:
561:
558:
555:
552:
549:
546:
545:
541:
526:
522:
515:
512:
501:
497:
491:
488:
477:
473:
466:
463:
458:
452:
448:
441:
438:
425:
421:
415:
413:
409:
396:
392:
386:
383:
378:
372:
368:
364:
357:
354:
343:
339:
332:
329:
322:
317:
313:
310:
307:
304:
301:
299:
296:
294:
291:
290:
286:
284:
277:
272:
267:
264:
263:
258:
255:
254:
249:
246:
245:
240:
237:
236:
231:
228:
227:
211:
207:
203:
200:
196:
193:
192:
187:
184:
183:
179:
177:
171:
167:
158:
135:
133:
129:
124:
118:
114:
109:
107:
103:
97:
89:
87:
85:
84:Windows Vista
81:
77:
73:
69:
66:
62:
61:Windows Logon
58:
51:
47:
43:
37:
32:
19:
2291:File Manager
2131:Photo Viewer
2066:Media Center
2026:Groove Music
1956:Address Book
1927:
1920:
1913:
1908:Purble Place
1906:
1899:
1892:
1885:
1878:
1873:Chess Titans
1871:
1864:
1851:Discontinued
1839:
1832:
1590:
1531:Ntoskrnl.exe
1439:Boot Manager
1431:Architecture
1321:Group Policy
1213:File systems
1113:Saved search
1020:Sticky Notes
985:Quick Assist
913:Media Player
883:Feedback Hub
878:Fax and Scan
773:Task Manager
703:Event Viewer
683:Disk Cleanup
528:. Retrieved
524:
514:
503:. Retrieved
499:
490:
479:. Retrieved
475:
465:
446:
440:
428:. Retrieved
423:
399:. Retrieved
394:
385:
362:
356:
345:. Retrieved
341:
331:
281:
174:userinit.exe
159:
136:
125:
110:
99:
60:
56:
55:
18:Winlogon.exe
2306:Minesweeper
2275:Spun off to
2096:MSN Dial-up
2091:Movie Maker
1996:Diagnostics
1946:ActiveMovie
1688:COMMAND.COM
1566:Shadow Copy
1421:Server Core
1261:Mount Point
1188:Shadow Copy
783:Windows Ink
151:ScreenSaver
121:wininit.exe
80:screensaver
2351:Categories
2286:DVD Player
2101:NetMeeting
2001:DriveSpace
1866:3D Pinball
1366:SharePoint
1130:Start menu
975:Phone Link
838:Calculator
793:PowerShell
654:Management
530:2020-09-27
505:2023-05-14
481:2023-05-14
420:"Desktops"
347:2023-05-14
323:References
168:or when a
46:Windows 11
36:Windows XP
2081:Messenger
2076:Messaging
2006:DVD Maker
1976:CD Player
1971:CardSpace
1922:Solitaire
1622:BitLocker
1617:AppLocker
1251:Hard link
1140:Task View
1118:Namespace
1088:ClearType
908:Messaging
893:Magnifier
858:Clipchamp
833:3D Viewer
525:The Verge
2325:Category
2202:MS-DOS 7
2187:ScanDisk
2106:NTBackup
1986:Contacts
1966:Cardfile
1901:Hold 'Em
1880:FreeCell
1726:VBScript
1637:Defender
1605:Security
1591:Winlogon
1546:Registry
1160:Services
1093:Explorer
1078:AutoPlay
965:Paint 3D
950:OneDrive
940:Narrator
888:Get Help
843:Calendar
738:Settings
708:IExpress
567:—
430:19 April
401:19 April
287:See also
162:Winlogon
143:Winlogon
115:and the
90:Overview
57:Winlogon
2301:Mahjong
2222:Interix
2156:WinHelp
2056:Journal
2046:Imaging
1894:InkBall
1780:DirectX
1743:ActiveX
1731:JScript
1444:Console
1416:Hyper-V
1311:Domains
1135:Taskbar
1108:IFilter
1083:AutoRun
1045:WordPad
1040:Weather
955:OneNote
945:Notepad
868:Cortana
743:Sysprep
314:In the
155:Default
147:Default
139:WinSta0
76:station
2334:
2323:
2296:Hover!
2170:Others
2151:Travel
2146:Syskey
1929:Tinker
1887:Hearts
1815:WinUSB
1800:WinAPI
1785:Native
1596:WinUSB
1521:MinWin
1298:Server
1098:Search
1010:Sports
980:Photos
970:People
848:Camera
453:
373:
2262:WinFS
2161:Write
1858:Games
1825:Games
1698:WoW64
1526:NTLDR
1516:LSASS
1449:CSRSS
1256:links
1231:exFAT
1060:Shell
1025:Store
1015:Start
1005:Skype
960:Paint
935:Money
863:Clock
810:WinRE
718:Netsh
656:tools
645:Games
309:getty
303:Vundo
271:GINAs
242:user.
233:GINA.
210:GINAs
206:GINAs
2336:List
2217:HPFS
1981:Chat
1939:Apps
1841:Surf
1790:.NET
1758:DCOM
1586:WHEA
1581:USER
1571:SMSS
1361:WSUS
1341:MSMQ
1283:ReFS
1246:NTFS
1221:CDFS
1178:CLFS
1173:BITS
1073:Aero
1050:Xbox
1030:Tips
918:2022
903:Maps
898:Mail
873:Edge
825:Apps
620:APIs
451:ISBN
432:2014
424:MSDN
403:2014
395:MSDN
371:ISBN
214:Ctrl
149:and
128:GINA
2116:Pay
2016:Fax
1763:OLE
1738:COM
1721:WSH
1708:API
1469:DLL
1464:EXE
1376:PWS
1356:IIS
1316:DNS
1288:UDF
1276:EFS
1271:TxF
1241:FAT
1236:IFS
1226:DFS
815:WMI
222:Del
218:Alt
123:).
2353::
633:NT
628:9x
523:.
498:.
474:.
422:.
411:^
393:.
340:.
145:,
108:.
601:e
594:t
587:v
533:.
508:.
484:.
459:.
434:.
405:.
379:.
350:.
220:+
216:+
59:(
52:.
20:)
Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.
