Winlogon Notification Packages Removed: Impact on Windows Vista Planning and Deployment

In Windows Vista and later, Winlogon notification packages are no longer supported. Winlogon notification packages are discussed in detail in the next section. After upgrading systems to Windows Vista, Winlogon will not load Winlogon notification packages. Organizations that are using Winlogon notification packages must either remove the functionality or create a new solution when deploying Windows Vista and later.

What Were Winlogon Notification Packages?

In pre-Windows Vista versions of Windows, Winlogon notification packages are registered DLLs that the Winlogon process loads. These DLLs receive Winlogon notifications and handle different Winlogon events. Winlogon previously supported the following events.

Previously supported Winlogon notification packages

The DLL could also impersonate the logged on user or be called asynchronously as well.

Winlogon notification packages are only supported in Windows 2000, Windows XP and Windows Server 2003. For more information about Winlogon notification packages, see "Winlogon Notification Packages" in Security (https://go.microsoft.com/fwlink/?LinkId=70570).

Identifying Winlogon Notification Packages

If a system is using a Winlogon notification package, it is registered in the registry under the following key:

HKEY_LOCAL_MACHINE|Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

The following Windows components use Winlogon notifications and their registration will exist in a default installation.

Windows Server 2003 SP 1:

• Crypt32chain: crypt32.dll
• Cryptnet: cryptnet.dll
• Cscdll: cscdll.dll
• Dimsntfy: dimsntfy.dll
• ScCertProp: wlnotify.dll
• Schedule: wlnotify.dll
• Sclgntfy: sclgntfy.dll
• Senslogn: wlnotify.dll
• Termsrv: wlnotify.dll
• Wlballoon: wlnotify.dll

Windows XP SP 2:

• Crypt32chain: crypt32.dll
• Cryptnet: cryptnet.dll
• Cscdll: cscdll.dll
• ScCertProp: wlnotify.dll
• Schedule: wlnotify.dll
• Sclgntfy: sclgntfy.dll
• Senslogn: wlnotify.dll
• Termsrv: wlnotify.dll
• Wlballoon: wlnotify.dll

Windows 2000 SP 4:

• Crypt32chain: crypt32.dll
• Cryptnet: cryptnet.dll
• Cscdll: cscdll.dll
• Sclgntfy: sclgntfy.dll
• Senslogn: wlnotify.dll
• Termsrv: wlnotify.dll
• Wzcnotif: wzcdlg.dll

Using Service Control Manager (SCM) Notifications

Service Control Manager (SCM) has notifications corresponding to most of the Winlogon notifications. Creating a service and using SCM notifications will not only work in Windows Vista, but also the same solution will work in Windows XP and Windows Server 2003 environments. SCM notifications are delivered asynchronously, but services can impersonate users if they have permission to find the user token based on the SessionId.

The service will need to register for its service control handler function to receive SCM notifications during the SetServiceStatus call. The SERVICE_STATUS structure (https://go.microsoft.com/fwlink/?LinkID=70746) will need to include SERVICE_ACCEPT_SESSIONCHANGE 0x00000080 as an accepted control. The following table has the corresponding HandlerEx control code and WM_WTSSESSION_CHANGE status code combination equivalent to each Winlogon event.

HandlerEx control codes

For additional information about HandlerEx, see HandlerEx in the System Services (https://go.microsoft.com/fwlink/?LinkId=70743).

For additional information about creating a service, see MSDN Services reference (https://go.microsoft.com/fwlink/?LinkId=70744).

Using the System Event Notification Service (SENS)

The System Event Notification Service (SENS) has notifications corresponding to most of the Winlogon notifications. Creating a new application using SENS will not only work in Windows Vista, but also the same solution will also work in Windows 2000, Windows XP, and Windows Server 2003 environments. Applications typically are not synchronous, but if the application process has SE_ASSIGNPRIMARYTOKEN_NAME and SE_INCREASE_QUOTA_NAME privileges, then it can impersonate users. SENS notifications do not have notifications corresponding to the following Winlogon events:

• Shutdown: Supported in SCM notifications. See Using Service Control Manager (SCM) Notifications.
• Startup: Creating a service that starts at startup would be an option.

The application will need to subscribe to one or more of the SENS logon events. The following table has the corresponding ISensLogon method equivalent to each Winlogon event.

ISensLogon methods

For additional information about ISensLogon, see ISensLogon in Network Management (https://go.microsoft.com/fwlink/?LinkId=70745).

Using Group Policy Scripts

Group policy provides administrators the ability to execute four types of scripts:

• Computer startup script
• Logon script
• Computer shutdown script
• Logoff script

For more information about how to create and target a script based Group Policy, see article 322241 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=73697)

Policy Settings Related to Script Processing

By default, all scripts are executed asynchronously to improve system boot and login performance. However, there is a Group Policy option to have scripts executed synchronously.

Please note that this is not a recommended configuration and should only be used if no other methods are available. You must also extensively test the script to ensure that it does not cause any system performance problems. The following are some of the relevant Group Policy settings associated with the script processing policy.

Computer configuration script options

Similar Group Policy settings are also available for user based logon or logoff scripts.

Security Context for Script Processing

Group Policy scripts are processed under the system context. In Windows Vista, both computer and user Group Policy scripts are executed in elevated mode (Scripts are run with a full administrator access token).