Microsoft® Windows® 2000 Security Handbook

Windows 2000 System Processes and Files

A quick summary of all the important system files I've discussed thus far is shown in Table 1.1.

Table 1.1. System Files

Name	Module Where Implemented	Mode	When Started/Loaded	By Whom
HAL.DLL	The Hardware Abstraction Layer	N/A	Boot	System
NTOSKRNL.EXE	The microkernel and executive	Kernel	Boot	System
KERNEL32.DLL,	Win32 Subsystem .DLLs	N/A	Boot	System
GDI32.DLL,	Win32 Subsystem.DLLs	N/A	Boot	System
USER32.DLL	Win32 Subsystem.DLLs	N/A	Boot	System
ADVAPI32.DLL	Win32 Subsystem.DLLs	N/A	Boot	System
SMSS.EXE	The Session Manager	User	Boot	System
WIN32K.SYS	Kernel mode components of Win32	Kernel	Boot	SMSS.EXE
CSRSS.EXE	The Win32 Subsystem processes	User	Boot	SMSS.EXE
WINLOGON.EXE	Windows Logon Process	User	Boot	SMSS.EXE
MSGINA.DLL	Default GINA	N/A	Boot	WINLOGON. EXE
LSASS.EXE ...