Kavinda Munasinghe’s Blog

Recently a friend of mine complained that he was unable to login into his PC. Windows kept logging him out just after validating the user name and password.

In summary this is what happened (Windows XP Professional)
-Booted up the PC. The Windows login screen appears without any problem.
-Entered valid domain accounts/local accounts with and without administrative privileges
-Credentials got validated.
-Immediately after, Windows started logging out.

Booting up in “Last Known Good Configuration”, “Safe Mode” and “Safe Mode with Command Prompt” or remotely connecting via “Remote Desktop” all had the same problem.

Since this PC was connected to a LAN, it was possible to remotely connect to the Windows “Event Viewer” to see what could be happening, but unfortunately it didn’t reveal any secrets. Connecting remotely to the Windows “Registry” of the effected PC was however much more productive; after a little bit of looking around I found an empty value for the Userinit entry. Adding it back solved the problem. If this happened on a PC that is not connected to a network, there is another way to fix the missing entry by getting windows to add the missing “userinit.exe” entry while booting up.

—
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=”C:\\Windows\\system32\\userinit.exe,”
—

This is what was happening: When a user presses CTRL+ALT+DEL and enters their username and password, the Windows Graphical Identification and Authentication component (GINA) will get an authentication package to verify the credentials and establish a session. Then GINA passes on the job of setting up the user environment to the programs specified in the WinLogon’s registry key for “Userinit”. Usually that would be “C:\WINDOWS\system32\userinit.exe,”. So, with no program specified to do the setting up, you immediately get logged out again.