track. Here is something else to ponder.
Logon Phase
The Windows subsystem starts Winlogon.exe, a system service that enables logging on and off. Winlogon.exe then does
the following:
Starts the Services subsystem (Services.exe), also known as the Service Control Manager (SCM).
Starts the Local Security Authority (LSA) process (Lsass.exe).
Parses the Ctrl+Alt+Del key combination at the Begin Logon prompt.
The Graphical Identification and Authentication (GINA) component collects the user name and password, and passes
this information securely to the LSA for authentication. If the user supplied valid credentials, access is granted
by using either the Kerberos V 5 authentication protocol or NTLM. For more information about security components,
such as LSA, Kerberos V5 protocol, or NTLM, see the Distributed Systems Guide of the Microsoft Windows 2000 Server
Resource Kit.
Winlogon initializes security and authentication components while the Service Control Manager initializes Auto-load
services and drivers. After the user logs on, the following events occur:
Control sets are updated.
The control set referenced by the LastKnownGood registry entry is updated with the contents in the Clone entry.
Clone, which is a copy of the CurrentControlSet entry, is created each time you start your computer. When a user
logs on, the LastKnownGood control set is updated with configuration information from the previous user session.
[/b] Group Policy settings take effect. [/b] [/u] This is the area that needs attention.[/u]
Group Policy settings that apply to the user and computer take effect. For more information about Group Policy, see
Chapter 1, ?Planning Deployments;? Chapter 5, ?Managing Desktops;? and Chapter 17, ?Managing Authorization and
Access Control,? and see ?Group Policy? in the Distributed Systems Guide of the Microsoft Windows 2000 Server
Resource Kit. Also, see the Change and Configuration Management Deployment Guide link on the Web Resources page at
http://www.microsoft.com/windows/reskits/webresources.
Startup programs run.
Windows XP Professional starts logon scripts, startup programs, and services referenced in these registry subkeys
and folder locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Runonce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion
\Windows\ Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\RunOnce
systemdrive\Documents and Settings\All Users\Start Menu\Programs\ Startup
systemdrive\Documents and Settings\username\Start Menu\Programs\ Startup
windir\Profiles\All Users\Start Menu\Programs\Startup
windir\Profiles\username\Start Menu\Programs\Startup
The windir\Profiles folders exist only on systems that are upgraded from Windows NT 4.0. For more information on
registry keys used for starting programs, see article 179365, ?INFO: Run, RunOnce, RunServices, RunServicesOnce and
Startup,? in the Microsoft Knowledge Base at http://support.microsoft.com. For additional information, see article
314488, ?How to Modify the List of Programs that Run When You Start Windows XP,? in the Microsoft Knowledge Base at
http://support.microsoft.com.
Windows XP Professional startup is not complete until a user successfully logs on to the computer.
