Everhart, Glenn
From:	Maxim Shatskih [maxim@vest.msk.ru]
Sent:	Monday, June 22, 1998 5:33 AM
To:	Johannes Rath; 'ntdev@atria.com'
Subject:	RE: [ntdev] watch keyboard stroke befor user logon
	>any side effects. Anyone who knows more about the loading
>sequence at
	>boot time?
	It is described somewhere in MSDN.
	1) NTLDR loads kernel, HAL, Boot class drivers, System registry
& 
	NLS translation tables.
	2) Boot class drivers are initialized.
	3) MmFreeLoaderBlock phase - registry seems to be fully 
	accessible after this.
	4) System class drivers are loades & initialized
	5) SMSS.EXE is launched. It is a very strange program. It does
not 
	use KERNEL32.DLL - only NTDLL.DLL. It seems to be started by 
	the kernel in some special way - not ordinary NtCreateProcess().
	6) SMSS launched AUTOCHK if necessary, then starts all 
	necessary subsystems listed in registry - this is Windows 
	subsystem (CSRSS.EXE + kernel-mode WIN32K.SYS).
	BTW, SMSS seems to be not only the same as UNIX's "init" 
	program, but also to be a server process for user-mode debugger 
	support.
	7) SMSS launches Winlogon.exe (which not only provides UI for 
	interactive logons, but also is a registry server which shares 
	machine's registry to the network).
	8) Winlogon shows its UI (by use of GINA DLL) and launches 
	LSASS.EXE & SERVICES.EXE in the background.
	9) SERVICES.EXE starts to launch Automatic class services & 
	devices (which seems to include all networking support). Any
logon 
	attempts (interactive or from SC controller) will block the
caller 
	thread till LSA will be completely initialized.
	You certainly can perform interactive logon while not all of the

	Automatic services are initialized (especially long-start ones
like 
	MSSQLServer).
	As about declaring user-mode service in Video group - it will
not 
	work. Video is System class driver (started by kernel's 
	I/O Manager after registry initialization but before SMSS
startup).
	User-mode service cannot be System class. It can only be 
	Automatic class (started by SC after Winlogon initialization &
after 
	Winlogon will show its UI).
	Group membership seems not to change this.
		
		Max
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[ To unsubscribe, send email to ntdev-request@atria.com with body
UNSUBSCRIBE (the subject is ignored). ]