Click on the image to zoom
Services Load Phase:
The services load phase initiates Session Manager, SMSS.EXE and will run the programs that are listed in its BootExecute Registry entry, along with starting the needed subsystems.
Win 32 Subsystem Start Phase:
When the 32 Subsystem starts it automatically initiates WINLOGON.EXE that starts the Local Security Authority LSASS.EXE and displays Ctrl+Alt+Delete logon dialog.
The Service Controller (Screg.exe) then checks the Registry for services that are marked to load automatically and loads them.
User Logon:
The Boot is not considered good until a user logs on successfully.
