Microsoft® Windows® 2000 Security Handbook

The Flow of a User Logon

An interactive user logon begins when a user at the local console activates the SAS (by pressing Ctrl+Alt+Del). Similarly, a network logon begins when the NetLogon service receives a request over the network for logon.

On activation of the SAS, WINLOGON jumps into action and switches to the secure desktop. Capturing of the user's credentials is handled by functions in the GINA, which WINLOGON calls at this time. Under the default configuration, WINLOGON displays the familiar security interaction dialog shown in Figure 3.11.

Figure 3.11. The familiar security interface dialog provided by the default GINA, MSGINA.