winlogonexe

Winlogon.exe is a core Windows subsystem process that handles interactive user logon, logoff, and workstation lock and unlock. It is part of the Windows logon process and runs with high privileges to coordinate credential validation, session initialization, and user state transitions. The legitimate file is located in the Windows System32 folder (for example C:\Windows\System32\Winlogon.exe) and is digitally signed by Microsoft.

In operation, Winlogon coordinates with the Local Security Authority (LSA) to validate user credentials and establish an initial user token. It hosts the logon user interface, which in modern Windows is provided by the LogonUI process and Credential Providers. On successful authentication, Winlogon loads the user profile, starts the user session, and transitions the system to the authenticated state. It also handles the Secure Attention Sequence (Ctrl+Alt+Del) to ensure credentials are entered in a trusted environment, and it participates in screen locking, unlocking, and user switching.

Historically, Winlogon replaced the older GINA-based logon mechanism beginning with Windows XP, and the logon UI moved to a separate LogonUI process driven by Credential Providers introduced with Windows Vista. Winlogon continues to manage session boundaries and coordinate with LSASS during sign-in and sign-out.

Security considerations: Winlogon.exe is a critical system component; tampering or replacement is a common tactic for malware. Legitimate Winlogon.exe should reside in System32 and be digitally signed by Microsoft. If a suspicious copy exists elsewhere or if there are repeated logon failures or system instability, it may warrant malware scanning and system integrity checks.