4.11.31. Winlogon process - Windows 2000

In Windows 2000, different RPC services run in the winlogon.exe process and are available on the following endpoints:

C:\>ifids -p ncacn_np -e \pipe\winlogonrpc \\.
Interfaces: 4
  894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0
  369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0
  a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0
  83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0

C:\>ifids -p ncacn_np -e \pipe\InitShutdown \\.
Interfaces: 4
  894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0
  369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0
  a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0
  83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0

Table 4.112. InitShutdown operations

InterfaceOperation numberOperation name
894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0: InitShutdown  
 0x00BaseInitiateShutdown
 0x01BaseAbortShutdown
 0x02BaseInitiateShutdownEx

profmap.dll DLL RPC service:

Table 4.113. pmapapi operations

InterfaceOperation numberOperation name
369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0: pmapapi  
 0x00ProfMapSrv_RemoteRemapUserProfile
 0x01ProfMapSrv_RemoteRemapAndMoveUser

wlnotify.dll DLL RPC service:

Table 4.114. GetUserToken operations

InterfaceOperation numberOperation name
a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0: GetUserToken  
 0x00SecpGetCurrentUserToken

The last interface is the sfcapi interface, documented in Section 4.11.28, “Windows File Protection”.