Flow
To assist you in keeping track of how Winlogon and GINA DLLs work, here is the flow and response:
Boot
Winlogon calls GINA's WlxNegotiate().
Winlogon calls GINA's WlxInitialize().
State of workstation becomes No One Logged On.
No one logged on
(GINA monitoring device(s) for SAS).
GINA calls WlxSasNotify() to indicate a SAS has been entered.
Winlogon delivers SAS back to GINA by calling GINA's WlxLoggedOutSas().
User logged on
GINA calls WlxSasNotify.
Winlogon delivers SAS back to GINA by calling GINA's WlxLoggedOnSas().
User logged on, wants to lock machine
GINA calls WlxSasNotify.
Winlogon delivers SAS back to GINA by calling GINA's WlxLoggedOnSas().
GINA returns WLX_LOCKWINSTA.
User logged on, windowstation locked, wants to unlock machine
GINA calls WlxSasNotify.
Winlogon delivers SAS back to GINA by calling GINA's WlxWkstaLockedSas().
GINA returns WLX_UNLOCKWINSTA.
User logged on, program issues ExitWindowsEx()
Winlogon calls GINA's WlxLogoff().
User logged on, wants to log off via SAS
GINA calls WlxSasNotify.
Winlogon delivers SAS back to GINA by calling GINA's WlxLoggedOnSas().
GINA returns WLX_LOGOFFUSER.
Winlogon calls GINA's WlxLogoff().
User logged on, wants to log off and shut down via ExitWindowsEx
Winlogon call's GINA's WlxLogoff().
Winlogon calls GINA's WlxShutdown().
User logged on, wants to log off and shu tdown via SAS
GINA calls WlxSasNotify.
Winlogon delivers SAS back to GINA by calling GINA's WlxLoggedOnSas().
GINA returns WLX_LOGOFFANDSHUTDOWN.
Winlogon calls GINA's WlxLogoff().
Winlogon calls GINA's WlxShutdown().