Draft:LogonUI

LogonUI
Component of Microsoft Windows
Windows11-10.0.22538.1000-LoginScreen.png
File name/executablelogonui.exe
LogonUI.exe
Other namesWindows Logon UI
Welcome screen
Typeuser interface
Introduced inWindows Neptune build 5111
Replaces
Classic login prompt

LogonUI, officially called Windows Logon UI, is a user interface that was intended to provide an easier and more friendly login experience. It contains most of the functionality of its earlier login prompt, with a revamped and more user-friendly UI. It also handles the Windows Security menu (invoked when pressing Ctrl+Alt+Del) starting with Windows Vista.

History[edit source]

Predecessors[edit source]

Before LogonUI was introduced, both Windows NT and Windows 9x used a login prompt, which was basic in terms of design and functionality. The Windows 9x family also contains a "Family Logon" interface, which was still a prompt but with a different design to provide a more friendly logon experience.

Neptune and Windows XP[edit source]

LogonUI was first introduced in Windows Neptune build 5111, however in Neptune and early builds of Windows XP, it was HTML-based (stored in LOGONHTA.DLL) and therefore relies on Internet Explorer technologies. As it was ported to Windows XP build 2223, the Windows logo at the top was changed to four orbs which were colored after the Windows logo, with every one showing a part of it. Starting with at least build 2225, it became DirectUI-based, and therefore does not require Internet Explorer to be functional. The UI was also updated to make use of fading and sliding animations.

A variation of the final design was seen in build 2415 (Lab06_N) and then introduced in build 2428, which would be finalized in build 2465. Builds 2474 and 2475 though have an animated Windows XP logo on the login screen, which would be reverted again in build 2481.

Longhorn and Vista[edit source]

Pre-reset[edit source]

In early builds (36834011), LogonUI features a live clock at the top right corner and a different color scheme to fit with the newly introduced Plex theme.

More significant updates to LogonUI were introduced in later builds of Longhorn: Build 4015 removed the live clock (this feature would return in Windows 8) and now consists of a box with the Windows logo above it and a milestone-appropriate background. With build 4029 (main), the Windows logo became transparent and now also slides from the top. The box now only appears when the user is prompted to log in. It also now handles the Windows Security menu, replacing Task Manager. To fit into the new design language of Milestone 7, the transparent Windows logo was replaced with the colored one from Windows XP. Also, the wallpaper changed to a skinny blue gradient, then in build 4048 to a solid black background. This design persisted up to the last pre-reset build.

Post-reset[edit source]

The development reset caused LogonUI to be reverted to the design seen in Windows XP. It was even temporarily disabled in Windows Vista build 5048, which caused the classic login prompt to be used by default. After it was reactivated in later builds, significant changes were made to LogonUI, as it now again handles the Windows Security options.

Starting with Windows Vista build 5308.6, LogonUI can have more users fit on the login screen, thus making having multiple users easier.

As a side effect when making LogonUI handle the Windows Security menu, if the LogonUI executable is missing, an error will pop up, making LogonUI mandatory starting with Vista.

Windows 7[edit source]

Although Windows 7 did not feature many changes to LogonUI, it shifted the keyboard input layout button from the bottom left to the top left corner and introduced the ability to use a custom background.

Windows 8 and 8.1[edit source]

Changes to LogonUI were hidden by default by the use of the Redpill feature lockout mechanism until they were implemented into the Windows base in build 8128.

In build 7875, the user profile buttons were enlarged to be more touch-friendly on tablets. A lock screen to show the date and time while logged off was added in build 7899, followed by many changes to the design until it was made fit with the Metro UI of Windows 8 and 8.1. Also, the keyboard input layout and Ease of Access buttons were shifted to the bottom right corner, next to the Power button, while a new one showing network connections has been added. However, it is still mostly DirectUI-based and is able to run without DWM, though with the swiping animation and the Power and Ease of Access menus being broken as they rely on DWM to render.

Builds from 7814 to 7880 contained an ability to use the current desktop wallpaper as LogonUI's background, which provides an user-friendly way to change the background without the use of registry editing or third-party softwares. This feature was later dropped in build 7899 and replaced with the ability to change the lock screen wallpaper and did not make its way to the final release.

Windows 10 and later[edit source]

Windows 10 marks the debut of the UWP-based LogonUI, as its functionalities and resources are now separated to multiple Windows.UI.Logon DLL files. This allows LogonUI to be updated more frequently in newer versions.

Although most functionalities and resources are now separated from the main executable, it still handles basic logging on and off functionalities and a command-line version of LogonUI, which is used for Windows Server Core, where Windows.UI.Logon DLL files do not exist. It can also be enabled on client versions and Windows Server with Desktop Experience by the method below.

Windows 10[edit source]

Since build 9845, changes were again locked, this time under the registry. The changes weren't enabled by default until build 10022 (fbl_impressive).

Builds from 9845 to 9924 feature a new layout for the default LogonUI from Windows 8, which adds a new user selection on the left side for easier switching. In build 9926, the profile picture is no longer squared, and the user selection is now located at the bottom left corner. The final design has been introduced in build 10159 and remained that way, with the user profile picture altered in the May 2019 update.

Windows 11[edit source]

The earliest available build (build 21996) has an unchanged LogonUI, with only the default lock screen wallpaper changed to a modified version of the Light Bloom wallpaper. A new design has been introduced in build 22000.51. While keeping the same layout as LogonUI in Windows 10, it shifted the clock in the lock screen to the top middle and updated elements to match with the Fluent design language.

In the future builds, features are now locked (or controlled-rollout) by the new Velocity staging system. The earliest build to do this is build 22543 with the new media controls on the Lock screen.

Trivia[edit source]

Findings[edit source]

Return to the old login prompt[edit source]

In Windows XP and early builds of Longhorn, other than using the User Accounts applet in Control Panel, the old login prompt can be brought back by the following methods:

  • Pressing Ctrl+Alt+Del three times in the LogonUI screen. It cannot be brought back again after pressing the key press without having to log off again.
  • Changing the registry value to configure LogonUI (located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, under the string value UIHost.) to blank.[a]

Console-mode LogonUI[edit source]

Windows 10 and newer include a command-line version of LogonUI, which is used in Windows Server Core by default starting with Windows Server 2016, replacing the regular LogonUI. It can also be enabled in Windows 10, 11 and Windows Server with Desktop Experience by using the following methods:

  • Creating a value called ConsoleMode in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\TestHooks and set it to 1
  • Renaming (or deleting) Windows.UI.Logon.dll in C:\Windows\System32.
Quirks[edit source]
  • When in client versions of Windows, the message to press Ctrl+Alt+Del can be shown even though it is not enabled, and pressing any key will bypass it.
  • If not using the Server Core version, after logging in and locking Windows by pressing Win+L, right clicking the command-line window, going to properties and pressing "Learn more about legacy console" will open up a web browser even though the system is locked.[b]

Server builds availability[edit source]

LogonUI was not present in the Windows Server line until Windows Server 2008 build 5112. Windows Server 2003 included it, but its resources are not installed and there is no UI to enable it and therefore continued to use the classic login prompt from Windows 2000 instead, which was completely phased out in the aforementioned build.

Gallery[edit source]

Neptune/Windows XP[edit source]

Longhorn[edit source]

Windows Vista[edit source]

Windows 7[edit source]

Windows 8/8.1[edit source]

Windows 10 and later[edit source]

Notes[edit source]

  1. This method can be used to use a custom modified LogonUI by simply changing the aforementioned value to the modified LogonUI executable.
  2. This can be used for various exploits, such as opening Command Prompt as SYSTEM to evade the permission errors or opening File Explorer and therefore, enable the taskbar right in the login screen