[ros-kernel] RE: Re: Desktop Stuff

[Steven E. <Ste...@kn...>]

What I mean to say was lsass doesnt draw the crt-alt-del windows but it
proccesses it either via the sam hash in the registry or via a BDC/PDC 

I was getting info from other security sites, the one I posted seemed to be
the better look at a NT system.

-----Original Message-----
From: Phillip Susi
To: ros...@re...
Sent: 11/7/01 7:26 PM
Subject: [ros-kernel] Re: Desktop Stuff

At 07:17 PM 11/7/2001 -0500, you wrote:

>According to a security analysis of Windows NT the Desktop seems
started 
>from Win32K.sys and managed from winlogon which then calls LSASS.EXE
for 
>the Control-Alt-Delete login box.

Where does this page say either of these things?  As far as I can tell, 
winlogon does create the desktop object ( though not the desktop window
) 
and also displays the GINA ( ctrl-alt-del box ), not lsass.  Lsass is
the 
process that is responsible for processing logon requests submitted by 
logon processes, by using authentication dlls, which is typically the
built 
in one that looks in the SAM or a DC on a domain.


><http://secinf.net/info/nt/analysis/index.html>http://secinf.net/info/n
t/analysis/index.html 
>
>
>Taken from Page 14 -
>
>WinLogon is the logon process. It is responsible for coordinating and 
>providing interfaces for interactive logon/logoff. Moreover, it manages

>the  Desktops. WinLogon registers itself with Win32, see below, during 
>system initialization as the logon process
This must be a typeo, it registers with lsass as a logon process - it is

lsass that handles logons, not win32k.sys


>Win32 makes Microsoft's 32-bit Windows API available to application 
>programs. In addition, it provides the graphical user interface and 
>controls all user input and output. Only two objects  are exported from

>this server:  WindowStation, i.e. user input/output system (mouse, 
>keyboard and screen), and a Desktop object.

====================================================
= To remove yourself from this mailing list, go to =
= http://www.reactos.com/home/mailing.html         =
====================================================
###########################################

This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange.
For more information, connect to http://www.F-Secure.com/