The interactive logon procedure is normally controlled by Winlogon, MSGina.dll, and network providers. To change the interactive logon procedure, MSGina.dll can be replaced with a customized GINA DLL. The purpose of a GINA DLL is to provide customizable user identification and authentication procedures. MSGina.dll does this by delegating SAS event monitoring to Winlogon, which receives and processes CTL+ALT+DEL secure attention sequences (SASs). A secure attention sequence (SAS) is a key sequence that begins the process of logging on or off. The default sequence is CTRL+ALT+DEL.
A custom GINA is responsible for setting itself up to receive SAS events (other than the default CTRL+ALT+DEL SAS event) and notifying Winlogon when SAS events occur. Winlogon will evaluate its state to determine what is required to process the custom GINA's SAS. This processing usually includes calls to the GINA's SAS processing functions.
The GINA operates in the context of the Winlogon process. As such, the GINA DLL is loaded very early in the boot process. The GINA DLL must follow rules so that the integrity of the system is maintained, particularly with respect to interaction with the user.
Note: GINA DLLs are ignored in Windows Vista.