dr3w2k3 Posted December 2, 2005 Share Posted December 2, 2005 Can anyone tell me why Winlogon.exe would be listed twice in the Task Manager? First thing that comes to mind is a virus or trojan but I have ran scans and all came back clean. Winlogin.exe, the Windows file, is supposed to be located in the System32 folder and if I do a search, that is the only one that comes up. So I dont have a rogue Winlogon.exe file anywhere on my PC. My system runs fine. It's just that I noticed the two entries today and I know that normally there should only be one. Any ideas?? :wacko: Link to comment Share on other sites More sharing options...
Vykranth Posted December 2, 2005 Share Posted December 2, 2005 Under which user names are the winlogon.exe running? Normally, winlogon.exe runs under SYSTEM?. Are they both under SYSTEM or is there one running under LOCAL SERVICE/NETWORK SERVICE? Have you check the registry base to see if winlogon appears in one of the run keys? Link to comment Share on other sites More sharing options...
dr3w2k3 Posted December 2, 2005 Author Share Posted December 2, 2005 Yup, I checked in the registry, nothing. Both are running under SYSTEM. Link to comment Share on other sites More sharing options...
John Veteran Posted December 3, 2005 Veteran Share Posted December 3, 2005 Do/did you have multiple users logged on at once? Winlogon runs a seperate instance for each user that is logged onto the machine. Reboot and log on with only one user account and I bet you only see one instance. Link to comment Share on other sites More sharing options...
Jesse Carlton Posted December 3, 2005 Share Posted December 3, 2005 (NOT SURE) but if you use the Run As... command to open a program, it may start a new instance to use that username's credentials. Link to comment Share on other sites More sharing options...
dr3w2k3 Posted December 3, 2005 Author Share Posted December 3, 2005 Do/did you have multiple users logged on at once? Winlogon runs a seperate instance for each user that is logged onto the machine. Reboot and log on with only one user account and I bet you only see one instance. Hmmmm...that might be it. I use Remote Desktop all the time on my PC so I bet that is it! Thanks! :) Link to comment Share on other sites More sharing options...
John Veteran Posted December 4, 2005 Veteran Share Posted December 4, 2005 (edited) (NOT SURE) but if you use the Run As... command to open a program, it may start a new instance to use that username's credentials. No, winlogon runs for logon procedures, not authentication. The Local Security Authority (LSA - lsass.exe) authenticates users, and it only runs one instance. Edited December 4, 2005 by John Link to comment Share on other sites More sharing options...
Recommended Posts