winlogon, which loads the graphical identification and authentication library. After a user has successfully logged into the machine, winlogon does the following: User and Computer Group Policy settings are applied. Startup programs are run from the following locations: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce All Users ProfilePath\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows) Current User ProfilePath\Start Menu\Programs\Startup\ (this path is localized on non-English versions of Windows) In Windows 95/98/ME, it was also possible to run a program before the user logs on by using RunServicesOnce or RunServices keys. In Windows NT, this has been replaced by the services.exe program, which is able to load a set of system services before a user logs on. Additionally, in English-language versions of Windows, the startup folder was called "StartUp" instead of "Startup" in Win9x. Due to the minimally restricted environment of these operating systems, any program can add itself to the Startup registry key or system folder. This method is frequently used by malware. Windows NT since Vista The sequence of booting Windows Vista and later versions is different from any previous version of Windows that uses the NT kernel. The operating system boot loader in Vista is called winload.exe, and is invoked by Windows Boot Manager. Additionally, the GINA that has been in use with all versions of Windows NT since 3.1 has been entirely replaced by "Credential Providers". See also Booting process of Linux References Windows architecture Booting