Edit

Interaction Between Winlogon and GINA

  • Article

Winlogon and the GINA must communicate initialization information, handle secure attention sequence (SAS) monitoring and notification, and permit logoff and shutdown activities. The state of Winlogon determines which GINA function is called to process any given SAS event. Communications occur in the order shown here.

Note

GINA DLLs are ignored in Windows Vista.

 

Event Description
Workstation boot
  1. Winlogon calls the GINA's WlxNegotiate function to notify the GINA about the version of Winlogon in use.
  2. Winlogon calls the GINA's WlxInitialize function to give the GINA the addresses of the support functions, a handle to Winlogon, and to obtain the context information for the GINA (to be used in all future calls to the GINA).
    Winlogon is in the logged-out state.
No one is logged on (The GINA monitors devices for SAS events).
  1. The GINA calls Winlogon's WlxSasNotify function when a SAS event has been received.
  2. Winlogon calls the GINA's WlxLoggedOutSAS function, allowing the GINA to process a user's identification and authentication information.
    When logon is successful, Winlogon is in the logged-on state.
The user is logged on (The GINA monitors devices for SAS events).
  1. The GINA calls Winlogon's WlxSasNotify function when a SAS event has been received.
  2. Winlogon calls the GINA's WlxLoggedOnSAS function, allowing the GINA to present options to the user who is currently logged on.
The user is logged on and wants to lock computer (The GINA monitors devices for SAS events).
  1. The GINA calls the WlxSasNotify function.
  2. Winlogon calls the GINA's WlxLoggedOnSAS function.
  3. The GINA returns WLX_SAS_ACTION_LOCK_WKSTA.
    Winlogon is in the workstation-locked state.
The user is logged on, the workstation is locked, and the user wants to unlock computer (The GINA monitors devices for SAS events).
  1. The GINA calls the WlxSasNotify function.
  2. Winlogon calls the GINA's WlxWkstaLockedSAS function.
  3. The GINA returns WLX_SAS_ACTION_UNLOCK_WKSTA.
The user is logged on, and the program calls the ExitWindowsEx function Winlogon calls the GINA's WlxLogoff function.
The user is logged on and wants to log off by using SAS (The GINA monitors devices for SAS events).
  1. The GINA calls the WlxSasNotify function.
  2. Winlogon calls the GINA's WlxLoggedOnSAS function.
  3. The GINA returns WLX_SAS_ACTION_LOGOFF.
  4. Winlogon calls the GINA's WlxLogoff function.
The user is logged on and wants to log off and shut down by using ExitWindowsEx
  1. Winlogon calls the GINA's WlxLogoff function.
  2. Winlogon calls the GINA's WlxShutdown function.
The user is logged on and wants to log off and shut down by using SAS (The GINA monitors devices for SAS events).
  1. The GINA calls the WlxSasNotify function.
  2. Winlogon calls the GINA's WlxLoggedOnSAS function.
  3. The GINA returns WLX_SAS_ACTION_SHUTDOWN.
  4. Winlogon calls the GINA's WlxLogoff function.
  5. Winlogon calls the GINA's WlxShutdown function.