Ending Winlogon.exe on various Windows versions!
Vložit
- čas přidán 26. 11. 2021
- Here is a video showing what happens when you terminate Winlogon.exe (Windows Logon Application) on various versions of Windows from Windows NT 4.0 up to Windows 11.
Music provided by Monstercat:
Vicetone & Cozi Zuehlsdorff - Nevada
/ monstercat
/ monstercatinstinct
SOCIAL MEDIA LINKS:
Twitter: / martinnobel_
Discord: / discord - Věda a technologie
I love how the classic theme has been so ingrained into Windows that it's the lowest layer of GUI Windows can load, giving us 3 rings of GUI:
1. Whatever normal Metro-like GUI comes with your system
2. Aero Basic
3. Classic
It's literally the first thing that can pop up on Windows when the GUI is deployed for the first time, or when whatever would normally run the GUI gets so fucked you're left with something from 20 years ago
Theres a software from windows (iirc it's a server thingy) that has gui from the windows 3-ish era
I find it funny how in windows nt 4-xp, it would crash the entire os, in vista-8.1 it would just log you off and in 10 and 11 it makes the windows have a weird glitchy vista safe mode classic theme and logs you off at a later time
@Soumodeep Guha I know it looks nice but performance just ew
@kinan YT gamer legendary 🕹️🥇 WDYM YPOU CAN'T WHAT I CAN'T SAY THE PERFORMANCE IS BAD?
@@SkylerIsAGoner you should be saying that for windows 10/11 windows vista is blazing fast because it's effectively the same as 7.
@@TsunamicBug gurl/sir I am talking about the crashes NOT the speed
@@SkylerIsAGoner You said "performance".
Crashes have to do with stability, performance almost always means speed.
Windows Vista and above systems have rewritten the NT kernel code, so the c0000021a blue screen of death will not appear when ending the winlogon.exe process, but will log out directly.
I think I understand why Windows 95-XP can't handle/work without winlogon.exe (it's like Windows 10/11 can't work without csrss.exe)
Explans why it wouldn’t crash the second the process is killed.
That's because the load chain for Winlogon was changed entirely. Now ntoskrnl.exe launches wininit.exe, which then launches winlogon.exe (and is responsible for relaunching it in case of its failure). It's simply another abstraction layer for security tokens between Ring 0 (kernel space) and Ring 3 (user space), created for the sole role not to give Winlogon sensitive tokens that can be used by old-era rootkits and also for privilege escalation attacks. Now Winlogon is responsible for the current login state, but user sessions are created from Wininit.
Fun fact: if you kill Wininit (or csrss), the kernel will bugcheck instantly the same way it did with NT/2K/XP systems. This is because with their termination, a part of cross-ring IPC communication APIs instantly cease to exist, and user space programs can no longer do any I/O, so the control switches to kernel space. And, the cost of patching memory of all running processes to address any newly created IPC is simply too high to even think about running now potentially unstable processes in the user space (what about fixing dangling mutexes, sockets and hardware queues?) The system termination/forced reboot is just the safest way out there.
Yeah, killing those processes is the exact Windows counterpart of killing init or systemd in POSIX systems.
*Weird Ending unlocked: Windows *10* and *11* traveled back into 2000s
It doesn't do that
Oh Yeah The Very Rare Windows 11 Classic theme is Here. So Interesting
its kinda like killing the process of dwm
stop Talking Like This
I like all content of Nobel tech
@@auroradotrocks I am a Plotagoner By The Way. I am a Plotagon user. Haha Better watch my vids to learn more
@@waynenathanieltheanimator doesn’t give you the right to talk like like a weirdo
2:26 ah yes my favorite program included with windows, *Tas*
It got glitched so that's why (it was about to log off, and then it logs in for you)
Saly cuotas xdddddddddddd
Saly cuotas xddddddddddddddddddddddddddddddddddddddddddddd
TAS
Tool Assisted Speedrun
NT 4-XP: Emergency shutdown (makes sure no process does harm)
Vista-8.1: Emergency logoff (makes sure no user program does harm)
10-11: Failsafe logoff (makes sure the programs exit gracefully)
Winlogon supplies a basic theme for the Windows Shell to render properly. Otherwise, you would have nothing as themes load after you log in. DWM and Explorer has failsafes for this since Windows 8 (as UWP toolkit needs DWM).
so the reason it takes a bit for 10 and 11 for seeming bugged before logging off is because it's properly exiting programs, but doesn't have the proper information to render themes etc. properly?
The announcement of Windows 11 just made Martin focus more on Windows content rather than Apple content
Wow that is awesome man!
0:59 The process of Windows XP terminating into the BSOD is pretty ominous. Comes to show how fast crap can hit the fan!
"crap can hit the fan" i've never heard that before
if you pause it right on time before it bsod it shows the classic theme with bigger taskbar
@@catwacatwai saw it without pausing
so what i noticed in windows xp+ is that the theme reverts to classic theme for a millisecond and then causes bsod/logs off the user it also happened in win vista/7 but it was much more tough to notice it
And the background changes on xp
The exact times were:
XP: A 3rd of a second (20 frames)
Vista: 5% of a second (3 frames)
7: Roughly 12% of a second (7 frames)
Your new channel icon is soo cool
I love your videos
Windows NT 4.0 to XP: blue screen of death
Windows Vista and 7: logs out
Windows 8.1: 'shuts down' and logs out
Windows 10: 'shuts down' and breaks UI; windows in Classic theme
Windows 11: same as Windows 10 but no icons on taskbar
thanks.
It's quite interesting seeing Windows XP actually show the process of entering Text Only mode as the drivers get disabled for the Bluescreen
@@kreuner11 - that is happening because on these systems GUI relies on the presence of DWM, which cannot function without Winlogon and also casually stops. (DWM handles window compositing and UX theming beginning with Windows Vista and requires exclusive GPU control.) And also, beginning from Vista, Winlogon no longer maintains cross-ring APIs (Wininit handles them now), so its death won't do much to the core system stability.
for the first time vista didn't got a blue screen ending a critical process
suuui
Ending winlogon.exe on Windows XP and earlier, can show a bsod (Blue Screen of Death).
Ending winlogon.exe on Windows Vista and later, you can be logged off.
I think the moon icon of winlogon.exe in older versions is from the NT 4.0 "Safe to turn off comouter" message, isn't it?
yup!
@@FoxyVulpes Why was it removed :(
Looked cool
@@lenni-builder update & modernisation - I had Windows NT 4 on a Pentium 3, and that message didn’t show up - instead, my PC shuts off, like a modern PC today. (yup, Windows NT 4 CAN do that, if you know, how!)
if you don't like correction don't click "*Read more*.
*computer
@commie-tdn actually, it was APM, not ACPI
Hi, Martin! You are my favourite CZcamsr
Interesting things happened differently.
Windows NT 4.0 - Windows XP was a blue screen. Windows Vista to Windows 8/8.1 logs off the user. Windows 10, 11 just blacks out the wallpaper plus the taskbar doesnt work perfectly. Then the windows look like themes in Windows 10 when you end DWM (i guess it is the same or not)
You also get logged off on windows 10 or 11 you just see classic theme for 10 second
And right after, it also logs off the user but it takes more time than vista/7/8.x that is instantly
1 word for xp: Legend
Thegend?
2 word for xp: Poor
Windows NT 4.0 - Windows XP : SYSTEM HALT
Windows Vista - Windows 8 : Logging off...
Windows 10 & 11 : Congrats, you totally borked visual themes, Logging off in a few seconds...
Vista-11 OK its fine just....
Windows 11: *My Theme Glitched*
Nt 4.0 to XP: Entire OS crashed/BSOD
Vista to 11: Logs you off sometimes glitching vista safe mode👉👈
So in older Windows, the computer will crash if you close it. In Vista and newer the computer will log you out.
the DWM.exe process is tied to Winlogon.exe, if you close the latter the former will also close. If you start winlogon.exe dwm.exe will also start.
One of the tricks people had for forcing the old UI without the DWM handling vsync was to suspend winlogon.exe and close dwm.exe, then resume winlogon.exe. This would prevent winlogon.exe from automatically restarting dwm.exe... the problem is that a major Windows 10 update in 2018 resulted in suspending winlogon.exe deadlocking the computer, so this trick no longer worked.
Whenever I end it on windows xp, it just goes to classic theme for a second then shuts down
It will crash instantly and your PC will experience BSOD
SP2?
@@lukeonuke SP3
If you're using VirtualBox like I do, then, it has a weird issue that might even be a long standing bug that doesn't allow the short BSOD to display. If one occurs in a VM, it just shuts down the VM. IDK why. FTR, the long BSOD will display no problem, and both VMWare and Virtual PC 2007 can display short BSODs without issue. Though it should be noted that in VPC, if automatic restart on system crash is enabled, which it is by default in Windows XP and newer, it won't show the BSOD, and just go straight to a restart.
I liked your video
Windows 11 in the rare classic theme.
with glitchy
Are you talking about me?
@Google Account bruh
@Google Account he’s my brother
@Akhilesh Sattanathan yea I changed my name so I have to change my logo
Windows XP is satisfying
The same. Because it has The Animation as well
Yea even to this day I still think XP is the best looking version of Windows its so clean yet simple.
Since when does Windows XP BSOD when you kill winlogon.exe? For me everytime I have killed winlogon.exe in Windows XP it just continues running for like a few seconds and then abruptly shuts down completely with no BSOD. like the entire system just powers off or in the case of a virtual machine, it just closes the virtual machine. However if you kill smss.exe and then kill winlogon.exe then the system will continue running and somewhat function normally but with no theming or sound and no way to shut down without force. Unless that's virtualbox only thing or a version specific thing?
> "somewhat function normally"
Press X to doubt.
This way you eliminate half of the IPC API between user and kernel space, which has implications every program you have opened doesn't have access to the hardware (no I/O, no proper privilege separation, etc.). This is called an unstable state - if you achieve an unstable state and continue operating, the system may behave unexpectedly, including hardware damage (on physical machines) or a virtualization platform complaining someone overstepped the boundaries.
@@TheLukasz032 When I said somewhat function normally. I meant the OS will be in a broken and unstable state but you can still do stuff, atleast in a VM although be it limited and glitchy. As for real hardware, i was tempted to try it on an old laptop that i don't care about much but I decided not to as there is some data on there that I didn't want to risk losing at the time. However I did try killing the winlogon.exe process on that laptop shortly after posting that comment. And yeah Windows XP does actually blue screen unlike in virtual box where it just shuts down the VM abruptly if smss.exe is still running.
Also I personally wouldn't even recommend anyone attempt to force an OS or any software to run in a broken and unstable state outside of a VM due to the risk of losing data or possible damage.
The classic theme cant be removed. Its very hidden and cant be acsessed easily
Yeah Right
@@waynenathanieltheanimator Hes not wrong. At least as far as build 1703 of Windows 10 is concerned. Its not so much that its hidden, Its used as a backstop in case of serious problems and Windows 10's visual style overrides it. Its possible to bring it back with a bit of modding, but because of progressive changes since version 10240, it would be VERY unstable and visually buggy.
if you kill the process in Windows 10 while in the login page, it Will login and Will corrupt all fonts weirdly, it's curious
WOW!
i love how all windows have errors and stuff but Vista, 7 and 8 just log you off
WOWW
1:53 wow you got poweriso
cool bro
How do you delete winlogon.exe anyway? When I click end process while it’s highlighted, it says “This task can’t be ended because this is a critical task”.
I don't know why did the fatal error screen came out when you end it's task in older versions on windows
Next: Ending ntoskernel.exe in different Windows versions!
Yea
It's like stopping your heart, so i'm 101% sure it will crash the system.
After ending "winlogon.exe", every Windows OS (NT 4.0 - XP) gets a blue screen of death from Windows Server 2003 until Windows Vista - 11, because, if you end "winlogon.exe", you will go back to the logon screen.
Finnaly a fast way to logoff
noic
I see old versions of windows to windows XP when I turn off winlogon.exe, I don't know if it goes to windows like vista to 10
Does this little Action affect my System deeper? I use Windows 10.
tld;drNo, it does not affect your system.
Winlogon.exe is an application that holds and manages the current session, but not with the methods you think it does. It stores an important flag that basically means "This person has logged in and is using the PC.". When you exit your session, shut down your computer or just lock it, winlogon is also terminated. If you terminate the app using Task Manager, it will act accordingly and lock your session because there is no application that would hold the flag "This person has logged in and is using the PC". You can then continue and use the PC normally.
0:16 when i run literally anything on my computer:
BSOD 💀
mac lovers are loving this!
With windows so when he kills it you can see the theme pretty much die off
Me: Can you handle without winlogon.exe?
Windows 95-XP: NO, it will break SYSTEM >:( (Crashes and BSOD occurs)
Windows Vista 7-11: YES, it's fine as long as you don't mess up the SYSTEM :) (it will automatically log you off instead of crashing)
(Windows 10 and 11 got glitched for some reason as well as interface with explorer.exe and taskbar - It will log you off anyway without data loss or BSOD and it will let you log in without major problems)
Note: Ending winlogon.exe is like ending csrss.exe (for Windows 95-XP)
Idk why Windows 95-XP cannot handle/work without Winlogon.exe
(All Windows versions can't work without csrss.exe)
Speaking of winlogon.exe, fake csrss.exe can be ended or deleted without making it crash (it may be a virus or fake execution file which is fake)
@@alexbalan_5623 - that's because Winlogon (until Vista) was ran directly by the NT kernel and had the duty to expose cross-ring APIs to the user space. On x86 protected mode (kernel and user space separation) programs all do their job (communicating with hardware, displaying UI, reading/writing files, etc.) via exposed kernel space APIs. Without those in place, the whole program operation was meaningless, including system processes - only kernel and drivers could operate.
the ones where they blue screen say fatal error. now we should have a evolution of fatal error screens
on Windows Vista, 7, 8, 8.1, 10 and 11, when you end Logon.exe, you basically Logoff
winlogin literally went from making your computer die and give you a fatal error to signing you out. thanks windows vista!
This Windows 10 classic which logon application, what happens exist?
Ultra OS(2003-2017)
end winlogon.exe
Shows black screen of death
Ultra OS XP(2010-)
end winlogon.exe
Actually logs off the user
Your computer unexpectedly logged off
Ultra OS is restarting...
Next video: Deleting CONHOST.EXE on different versions of Windows
that will just break cmd wont it?
Interestingly, on Windows XP, I never saw a BSOD while on Windows 10 about 10 times
this is an advantage for malwares
well you can tell windows is getting more resistant...
How to kill the windows XP:
Trow the "my computer" on the Ribbish Bin
When you end winlogon.exe,DWM will also ended.
I once ended Winlogon.exe on Windows 7. It logged me off, but there were no user accounts until I restarted
The reason the window borders are so thick in Windows 10/11 in classic theme is probably to make them easier to grab and drag. I think I changed mine once to be narrower and then when I rebooted and went back to normal, they were harder to grab.
They are that thick because those are the values used by the Aero Basic theme. It doesn't actually switch to Windows Classic theme. It just uses the last available theming layer [DWM Compositor (Aero Glass) > Visual Style (Aero Basic/Luna) > Color Scheme (Classic)].
I think because WinLogon has a ThemeSection handle, and if it is closed programs use classic theme after the handle is closed. Programs left open remain the same.
windows xp just got a dark blue background and internet explorer suddenly spawned in the desktop,that is why peoples love xp?
What XP theme are you using? It looks great.
Theme of the gods
Royale (Energy Blue)
Luna
Can anyone please send me the link to the "process explorer" for windows nt 4.0? I really need it...
On Windows Vista-8.1 ending winlogon.exe equals to Emergency logoff
0:33 Windows 2000
1:09 Windows Vista
2:02 Windows 10
Winlogon.exe ended process in log off 1:18
XP goes Buh bye
Wow
Its safe in vista,7,8,8.x,10,11
2:25 classic theme on windows 10😳
AAAAAAAAAAAAAAAAH! HAVE YOU LOST YOUR MIND!!!!
I WILL NEVER DO THIS IN WINDOWS XP IN VIRTUAL BOX
It is not permanent damage
Kid calm down.
Before vista: bsod
After vista: lock screen
all killing winlogon.exe does is kill the user session winlogon.exe was running on
i dont get why it would cause a bsod up to windows xp
I just found out that Windows 11 has it
UMM I'VE BEEN SUBED BEFORE NOBEL TECH WAS VEFIFIED
You always love the first song?
In my pc its deletes my account if i restart, my pc in a boot delete.
Request Ending Winlogon.exe in beta version of windows
Windows nt4-xp: IF IM DYING YOU'RE DYING WITH ME
Windows 7-8.1: could've clicked log out but whatever
Windows 10-11: you lost your data btw here's a vista safe mode desktop because why tf not
man can you help me? I cant enter to windows 10 because of winlogon
1:00 a blue screen as the desktop background for a sec
I love how windows 11 has 100% cpu usage lol
It’s the blue screen of death (bsod)
In Windows 10 1709 it make logon unusable (like deleting authui.dll)
Really interesting that Vista+ don't BSOD, just log you out. Pretty good if, for some reason, your Start Menu doesn't work and you have to shut down the PC.
Plzzz how to fix that i accidently do it on my windows 8.1 😔😔😢
i tested it on Windows Longhorn 4074 and its just logged off
MUSIC?
You can use windows vista ultimate for me🥺
*Windows 95, 98, ME, & Server 2003 has left the chat*
Sleep the windows
on my windows 7 i crashed Winlogon.exe and it showed the lock screen
Excuse me, In WINDOWS Vista,7,8,8.1,10,11, if we Ending Winlogon.exe, what happen?
It simply logs off
winlogon.exe+end process=BSoD
what about wininit,exe, Martin?
instant crash
It's a BSOD on all of the Windows versions
Wininit actually is what was refactored out of Winlogon and abstracted away before it in the OS user-space process load chain.
Interesting to see the moment before BSOD in XP
Another thing, I see you are ending winlogon.exe with Task Manager in Vista and later instead of Process Explorer in prior versions
Does Windows Vista and later also just restart winlogon.exe if ending with Process Explorer?
What if doing the same thing in WinPE?
One idea: What if replacing bootim.exe with another file, like taskmgr.exe or cmd.exe?
He used Process Explorer because older versions of taskmgr does not allow user to end system processes.
For vista and above there is no difference on what way the process was killed.
@@gradlex Surely I know that old taskmgr prevents that, what I mean is expecting a "consistent" way on doing a job...
2:24 DWM ended
song?
ending windows winlogon.exe
suddenly bsod:nt 4.0-windows xp
have the must login again:windows vista-present os
Let's try