|
From: Steven E. <Ste...@kn...> - 2001-11-08 00:20:40
|
According to a security analysis of Windows NT the Desktop seems started from Win32K.sys and managed from winlogon which then calls LSASS.EXE for the Control-Alt-Delete login box. http://secinf.net/info/nt/analysis/index.html Taken from Page 14 - WinLogon is the logon process. It is responsible for coordinating and providing interfaces for interactive logon/logoff. Moreover, it manages the Desktops. WinLogon registers itself with Win32, see below, during system initialization as the logon process Win32 makes Microsoft's 32-bit Windows API available to application programs. In addition, it provides the graphical user interface and controls all user input and output. Only two objects are exported from this server: WindowStation, i.e. user input/output system (mouse, keyboard and screen), and a Desktop object. ########################################### This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange. For more information, connect to http://www.F-Secure.com/ |