Edit

Registry Entries (Authentication)

  • Article

In order for your package to receive event notifications from Winlogon, you must provide the name of the package, the names of the event handler functions in the package, the DLL responsible for implementing the package, and information about whether the DLL supports asynchronous events and impersonation.

You should create the notification package registry key as a subkey of

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

The name of the key is usually the same as the name of the DLL; however, this is not mandatory. The name chosen for your package must not conflict with the names of other installed notification packages.

In the Notify registry key, create the following registry values if there is a relevant event handler function in your package.

Value name [data type] Description
Asynchronous[REG_DWORD]
 Indicates whether the package can handle events asynchronously. If this value is set to 1, Winlogon calls the package functions in a separate thread. Otherwise, it does not.
DllName[REG_EXPAND_SZ]
 Name of the DLL that implements the notification package, for example: "Notify.dll".
Impersonate[REG_DWORD]
 Indicates whether Winlogon should impersonate the security context of the logged-on user when it calls the notification package functions. If this value is set to 1, Winlogon uses impersonation. Otherwise, it does not.
Lock[REG_SZ]
 Name of the function which handles desktop lock events, for example: "WLEventLock".
Logoff[REG_SZ]
 Name of the function which handles logoff events, for example: "WLEventLogoff".
Logon[REG_SZ]
 Name of the function which handles logon events, for example: "WLEventLogon".
Shutdown[REG_SZ]
 Name of the function which handles shutdown events, for example: "WLEventShutdown".
SmartCardLogonNotify[DWORD]
 Indicates whether Winlogon should generate a notification for logon events from smart cards. If this value is set to 1, Winlogon allows smart card notifications. Otherwise, it does not.
StartScreenSaver[REG_SZ]
 Name of the function that handles screen saver start events, for example: "WLEventStartScreenSaver".
StartShell[REG_SZ]
 Name of the function that handles shell start events, for example: "WLEventStartShell".
A shell start event occurs after the user has logged on but before the desktop appears. It differs from the logon event in that the user's security context has been established, and resources such as network connections are available.
Startup[REG_SZ]
 Name of the function that handles system startup events, for example: "WLEventStartup".
StopScreenSaver[REG_SZ]
 Name of the function that handles screen saver stop events, for example: "WLEventStopScreenSaver".
Unlock[REG_SZ]
 Name of the function that handles desktop unlock events, for example: "WLEventUnlock".