The Windows logon is implemented as a DLL, which is loaded during USER32 server initialization. When a windowstation is created a call is made to the logon DLL to start a logon thread to handle logons on the new windowstation.