Windows internals makes it clear than winlogon.exe after authenticating with lsass.exe launches the contents of the UserInit key, which by default is c:\windows\system32\userinit.exe
to set up the environment and then launches whatever is specified in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
which by default is explorer.exe
but why is there a wow64 version of userinit? ( ie c:\windows\syswow64\userinit.exe)
Specifically the question is revolving around the fact that the native binaries for staturp, lsass,winlogon and the like are already 64 bit and will use a 64 bit version, so what is the need for a 32 bit version of userinit?
Windows – Why is there a c:\windows\syswow64\userinit.exe on 64 bit versions of windows
64-bitstartupwindows
Related Topic
- Windows – \Program Files vs. \Program Files (x86) in 64-Bit Windows
- Windows – Correct technique to find application in 32 and 64 bit versions of Vista/Windows 7 from CMD.EXE
- Windows – Anything to share a printer from 32-bit to 64-bit Windows
- Windows – How to tell if a Windows application requires 64-bit
- Using 64 bit wuauclt from 32 bit command prompt
Best Answer
For the same reason there's a SysWOW64 version of almost every other Microsoft binary: compatibility with 32bit applications. Maybe no one will ever use it, but as soon as Microsoft stops distributing the 32bit version of the binary, be it calc.exe or ping.exe or Bubbles.scr, someone, somewhere, using some crappy old 32bit app, will complain.