Winlogon Structure
Winlogon has a main body that handles non-user interface and authentication policy independent functions. This main program loads a GINA DLL that should include all authentication policy and is expected to perform all identification and authentication user interactions. In addition to the main body and the GINA, Winlogon may load zero or more network providers which need to perform secondary authentication. The following diagram illustrates the Winlogon structure.
Figure 1 Winlogon Structure