Ending Winlogon.exe on various Windows versions! 

Theres a software from windows (iirc it's a server thingy) that has gui from the windows 3-ish era

@Soumodeep Guha I know it looks nice but performance just ew

@kinan YT gamer legendary 🕹️🥇 WDYM YPOU CAN'T WHAT I CAN'T SAY THE PERFORMANCE IS BAD?

@@Skyler2.0_RU-vid you should be saying that for windows 10/11 windows vista is blazing fast because it's effectively the same as 7.

@@TsunamicBug gurl/sir I am talking about the crashes NOT the speed

@@Skyler2.0_RU-vid You said "performance". Crashes have to do with stability, performance almost always means speed.

I think I understand why Windows 95-XP can't handle/work without winlogon.exe (it's like Windows 10/11 can't work without csrss.exe)

Explans why it wouldn’t crash the second the process is killed.

That's because the load chain for Winlogon was changed entirely. Now ntoskrnl.exe launches wininit.exe, which then launches winlogon.exe (and is responsible for relaunching it in case of its failure). It's simply another abstraction layer for security tokens between Ring 0 (kernel space) and Ring 3 (user space), created for the sole role not to give Winlogon sensitive tokens that can be used by old-era rootkits and also for privilege escalation attacks. Now Winlogon is responsible for the current login state, but user sessions are created from Wininit. Fun fact: if you kill Wininit (or csrss), the kernel will bugcheck instantly the same way it did with NT/2K/XP systems. This is because with their termination, a part of cross-ring IPC communication APIs instantly cease to exist, and user space programs can no longer do any I/O, so the control switches to kernel space. And, the cost of patching memory of all running processes to address any newly created IPC is simply too high to even think about running now potentially unstable processes in the user space (what about fixing dangling mutexes, sockets and hardware queues?) The system termination/forced reboot is just the safest way out there. Yeah, killing those processes is the exact Windows counterpart of killing init or systemd in POSIX systems.

so the reason it takes a bit for 10 and 11 for seeming bugged before logging off is because it's properly exiting programs, but doesn't have the proper information to render themes etc. properly?

its kinda like killing the process of dwm

stop Talking Like This

I like all content of Nobel tech

@@auroradotrocks I am a Plotagoner By The Way. I am a Plotagon user. Haha Better watch my vids to learn more

@@waynenathanieltheanimator doesn’t give you the right to talk like like a weirdo

It doesn't do that

"crap can hit the fan" i've never heard that before

if you pause it right on time before it bsod it shows the classic theme with bigger taskbar

​@@catwacatwai saw it without pausing

It got glitched so that's why (it was about to log off, and then it logs in for you)

Saly cuotas xdddddddddddd

Saly cuotas xddddddddddddddddddddddddddddddddddddddddddddd

TAS Tool Assisted Speedrun

thanks.

@@kreuner11 - that is happening because on these systems GUI relies on the presence of DWM, which cannot function without Winlogon and also casually stops. (DWM handles window compositing and UX theming beginning with Windows Vista and requires exclusive GPU control.) And also, beginning from Vista, Winlogon no longer maintains cross-ring APIs (Wininit handles them now), so its death won't do much to the core system stability.

with glitchy

Are you talking about me?

@Google Account bruh

@Google Account he’s my brother

@Akhilesh Sattanathan yea I changed my name so I have to change my logo

And the background changes on xp

The exact times were: XP: A 3rd of a second (20 frames) Vista: 5% of a second (3 frames) 7: Roughly 12% of a second (7 frames)

suuui

You also get logged off on windows 10 or 11 you just see classic theme for 10 second

And right after, it also logs off the user but it takes more time than vista/7/8.x that is instantly

yup!

@@FoxyVulpes Why was it removed :( Looked cool

​@@lenni-builder update & modernisation - I had Windows NT 4 on a Pentium 3, and that message didn’t show up - instead, my PC shuts off, like a modern PC today. (yup, Windows NT 4 CAN do that, if you know, how!)

if you don't like correction don't click "*Read more*. *computer

@commie-tdn actually, it was APM, not ACPI

Vista-11 OK its fine just.... Windows 11: *My Theme Glitched*

It will crash instantly and your PC will experience BSOD

SP2?

@@lukeonuke SP3

If you're using VirtualBox like I do, then, it has a weird issue that might even be a long standing bug that doesn't allow the short BSOD to display. If one occurs in a VM, it just shuts down the VM. IDK why. FTR, the long BSOD will display no problem, and both VMWare and Virtual PC 2007 can display short BSODs without issue. Though it should be noted that in VPC, if automatic restart on system crash is enabled, which it is by default in Windows XP and newer, it won't show the BSOD, and just go straight to a restart.

that will just break cmd wont it?

Idk why Windows 95-XP cannot handle/work without Winlogon.exe (All Windows versions can't work without csrss.exe)

Speaking of winlogon.exe, fake csrss.exe can be ended or deleted without making it crash (it may be a virus or fake execution file which is fake)

@@alexbalan_5623 - that's because Winlogon (until Vista) was ran directly by the NT kernel and had the duty to expose cross-ring APIs to the user space. On x86 protected mode (kernel and user space separation) programs all do their job (communicating with hardware, displaying UI, reading/writing files, etc.) via exposed kernel space APIs. Without those in place, the whole program operation was meaningless, including system processes - only kernel and drivers could operate.

The same. Because it has The Animation as well

Yea even to this day I still think XP is the best looking version of Windows its so clean yet simple.

Yea

It's like stopping your heart, so i'm 101% sure it will crash the system.

Your computer unexpectedly logged off Ultra OS is restarting...

Thegend?

2 word for xp: Poor

They are that thick because those are the values used by the Aero Basic theme. It doesn't actually switch to Windows Classic theme. It just uses the last available theming layer [DWM Compositor (Aero Glass) > Visual Style (Aero Basic/Luna) > Color Scheme (Classic)].

I think because WinLogon has a ThemeSection handle, and if it is closed programs use classic theme after the handle is closed. Programs left open remain the same.

> "somewhat function normally" Press X to doubt. This way you eliminate half of the IPC API between user and kernel space, which has implications every program you have opened doesn't have access to the hardware (no I/O, no proper privilege separation, etc.). This is called an unstable state - if you achieve an unstable state and continue operating, the system may behave unexpectedly, including hardware damage (on physical machines) or a virtualization platform complaining someone overstepped the boundaries.

@@TheLukasz032 When I said somewhat function normally. I meant the OS will be in a broken and unstable state but you can still do stuff, atleast in a VM although be it limited and glitchy. As for real hardware, i was tempted to try it on an old laptop that i don't care about much but I decided not to as there is some data on there that I didn't want to risk losing at the time. However I did try killing the winlogon.exe process on that laptop shortly after posting that comment. And yeah Windows XP does actually blue screen unlike in virtual box where it just shuts down the VM abruptly if smss.exe is still running. Also I personally wouldn't even recommend anyone attempt to force an OS or any software to run in a broken and unstable state outside of a VM due to the risk of losing data or possible damage.

tld;drNo, it does not affect your system. Winlogon.exe is an application that holds and manages the current session, but not with the methods you think it does. It stores an important flag that basically means "This person has logged in and is using the PC.". When you exit your session, shut down your computer or just lock it, winlogon is also terminated. If you terminate the app using Task Manager, it will act accordingly and lock your session because there is no application that would hold the flag "This person has logged in and is using the PC". You can then continue and use the PC normally.

BSOD 💀

It is not permanent damage

Kid calm down.

He used Process Explorer because older versions of taskmgr does not allow user to end system processes. For vista and above there is no difference on what way the process was killed.

@@gradlex Surely I know that old taskmgr prevents that, what I mean is expecting a "consistent" way on doing a job...

instant crash

It's a BSOD on all of the Windows versions

Wininit actually is what was refactored out of Winlogon and abstracted away before it in the OS user-space process load chain.

It simply logs off

Theme of the gods

Royale (Energy Blue)

Luna

Virtual machine...

it's a virtual machine