What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

The correct answer is C. LSASS.EXE. During the Windows XP boot sequence, several files play distinct roles: NTLDR is the bootloader, NTDETECT.COM detects hardware, and NTOSKRNL.EXE is the OS kernel. At the end of the boot process, once the kernel and session manager (SMSS.EXE) have initialized, LSASS.EXE (Local…

Submitted by viktor_hu· Apr 18, 2026Disk Forensics

Question

Options

ANTOSKRNL.EXE
BNTLDR
CLSASS.EXE
DNTDETECT.COM

How the community answered

(39 responses)

A
3% (1)
B
3% (1)
C
87% (34)
D
8% (3)

Explanation

During the Windows XP boot sequence, several files play distinct roles: NTLDR is the bootloader, NTDETECT.COM detects hardware, and NTOSKRNL.EXE is the OS kernel. At the end of the boot process, once the kernel and session manager (SMSS.EXE) have initialized, LSASS.EXE (Local Security Authority Subsystem Service) is responsible for enforcing security policy and initiating the Winlogon process, which presents the logon dialog box to the user. LSASS handles authentication and is the final piece that makes interactive login possible.

Topics

#Windows XP Boot Process#LSASS.EXE#System Files#Logon Process

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice