Session Manager, Winlogon, and the shell
The early user-mode path from system process creation to an interactive desktop.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
Process tree explorer
Walk a sample parent/child tree from System to Explorer and a user app.
Open labOfficial Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
This is where Windows turns a running kernel into a usable logged-in environment.
Mental model
After kernel initialization, Windows still needs to build sessions, start subsystems, present logon, and launch the shell.
How it works
- 1SMSS creates foundational session infrastructure and starts critical subsystem processes.
- 2Winlogon and related components handle secure attention and user authentication flow.
- 3Explorer and user services bring up the familiar desktop environment.
Key terms
- Session 0
- The non-interactive service session created early during startup.
- Explorer
- The Windows shell process that provides the desktop and taskbar experience.
A black screen after login
The kernel may already be fine while later user-session components fail to complete shell startup.
Common misconception
Login success is not the same thing as full desktop initialization.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
beginner
Authentication & logon
How Windows turns credentials into authenticated sessions, security contexts, and usable access tokens.
Next step in your guided path
intermediate
Winlogon, LogonUI, and session sign-in
The visible and semi-visible path from secure attention to a fully signed-in session.
Related topic
beginner
Services & background infrastructure
How Windows launches, groups, isolates, and supervises long-running background components.
Related topic
Related topics
Services & background infrastructure
How Windows launches, groups, isolates, and supervises long-running background components.
Processes & threads
How Windows represents work, isolates applications, and schedules execution.
Winlogon, LogonUI, and session sign-in
The visible and semi-visible path from secure attention to a fully signed-in session.
Window stations & desktops
The session-side objects that organize visible desktops, input, and GUI isolation.