In computing, a login session (or logon session on Windows NT-based systems) is the period of activity between a user logging in and logging out of a (multi-user) operating system. On Unix and Unix-like operating systems, a login session takes one of two main forms:
When a textual user interface is used, a login session is represented as a kernel session — a collection of process groups with the logout action managed by a session leader. Where an X display manager is employed, a login session is considered to be the lifetime of a designated user process that the display manager invokes. On Windows NT-based systems, logon sessions are maintained by the kernel, and control of them is overseen by the Local Security Authority Subsystem Service (LSASS). On user authentication, Winlogon requests LSA to create a logon session and a corresponding token including a logon ID, a 64-bit value identifying the session. Each process started on the system is tied to a token. On logout, the system requests all of the processes belonging to a logon session to close. Windows has three logon sessions that start on boot, with hardcoded logon IDs: SYSTEM (logon ID 999/0x3e7), Local Service (997/0x3e5), and Network Service (996/0x3e4). A special type of logon session also exists for null sessions.
See also Booting process of Windows NT Architecture of Windows NT Booting Master boot record Power-on self-test BootVis
References
Further reading Microsoft. "How Interactive Logon Works". Windows Server 2003 Technical Library. Archived from the original on 2006-05-07. Retrieved 2006-05-24.