The Logon Process:

1. Winlogon sends username/password to Lsass Winlogon sends username/password to Lsass.
 - Either on local system for local logon, or to Netlogon service on a domain

2. Creates processes for executables listed in
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Userinit
 - By default: Userinit.exe
 - Runs logon script, restores drive-letter mappings, starts shell

3. Userinit creates a process to run
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Shell
 - By default: Explorer.exe

4. There are other places in the Registry that control programs that start at logon