Winlogon Shell and Userinit

What Windows starts as the desktop shell and user set-up at every logon.

Use it to check whether extra programs run at every logon through Shell or Userinit, and find stored logon passwords.

SOFTWARE
Persistence

What It Is

Winlogon is the Windows component that runs each interactive logon, and this key holds two values it reads, Shell and Userinit. Shell is the desktop that starts, normally explorer.exe, and Userinit is the program that sets up the session, normally userinit.exe. Anything added to either value runs at every interactive logon for every user, so an extra program here is a common way to keep a foothold. The key also holds the automatic logon settings, which can keep a password in plain text.

What It Proves

Anything added to Shell or Userinit runs at every interactive logon, for every user. A changed value is persistence until proven otherwise.

What It Does Not Prove

Shows the current values only. The key holds many settings that change for benign reasons, so its last write time is a weak signal.

Where It Lives

Winlogon Shell and Userinit lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Winlogon Shell and Userinit, each with what it tells you
Registry Value	What It Tells You
`Shell` `REG_SZexplorer.exe`	Shell holds only the default, explorer.exe, so nothing extra starts here. Check the same value under HKCU too.
`Userinit` `REG_SZC:\Windows\system32\userinit.exe,C:\Users\Public\upd.exe`	C:\Users\Public\upd.exe runs alongside userinit.exe at every interactive logon, for every user. Treat it as persistence, so hash it and find who changed the value.
`AutoAdminLogon` `REG_SZ1`	Automatic logon is on, for svc-reception, and DefaultPassword in this key holds its password in clear text. Treat that account as exposed and rotate the password.

How to Read It

Shell should be explorer.exe and Userinit C:\Windows\system32\userinit.exe, with a trailing comma. Anything after those, separated by commas, is an extra program that runs at logon. Check the same values under HKCU too. AutoAdminLogon 1 with DefaultPassword means a password in plain text.

When Windows Writes It: Windows writes it when an administrator, an installer or an attacker changes a value, and it updates some values itself.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

The live tools that record Registry writes catch a change to Shell or Userinit and keep the old value, so you can see what was added. Process creation records show the extra program running at logon.

Sees It DirectlyDeviceRegistryEvents

Defender records writes to these values and keeps the previous data, so you can see what changed.

KQLDefender XDR, Advanced hunting

// Changes to Winlogon Shell and Userinit, with the old dataDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey endswith @"\Windows NT\CurrentVersion\Winlogon"| where RegistryValueName in~ ("Shell", "Userinit")| project Timestamp, ActionType, RegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Winlogon Shell and Userinit shows.

Automatic LogonExplains the AutoAdminLogon value in this key, and the password it can keep in clear text.
AmcacheGives the added program's SHA-1 and publisher, to tell it from Windows' own files.
Process Starts at Logon, Security Event 4688Not in the RegistryShows the added program running at each logon, which the values alone cannot.

Sources

The facts on this page come from these public pages, which say more on each point.