Winlogon Notify, Taskman and App
Older Winlogon logon hooks beside Shell and Userinit, mostly legacy on Windows 11.
Use it to spot values added to the older Winlogon hooks beside Shell and Userinit, a sign of tampering.
- SOFTWARE
- Persistence
What It Is
Winlogon is the Windows component that manages interactive sign-in and sign-out. Its key in HKLM SOFTWARE holds logon settings beside the main Shell and Userinit values, including a Notify subkey where notification package DLLs were registered to handle Winlogon events. An AppSetup value can name programs such as Usrlogon.cmd that run at logon on a Terminal Server. These Winlogon notification packages and the GINA are from older Windows and are ignored from Windows Vista onward.
What It Proves
Up to Windows Vista, Explorer ran the Taskman command line when it started as the shell. AppSetup lists programs run at logon, and the legacy Notify subkeys named DLLs the logon process loaded. Each was a place to run code at logon, so a value still marks tampering.
What It Does Not Prove
On Windows 7 and later Explorer no longer runs Taskman, and Notify DLLs stopped loading after Windows XP and Server 2003. So treat both as legacy locations that flag tampering rather than active autoruns. Taskman is absent by default and AppSetup is empty except on Remote Desktop servers, where Usrlogon.cmd is normal.
Where It Lives
Winlogon Notify, Taskman and AppSetup lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Taskman is absent, which is the normal state. Explorer runs it only up to Windows Vista, so treat it as legacy. A value here would still flag tampering. |
| AppSetup is not set, as on a workstation. Remote Desktop servers keep Usrlogon |
| No Notify key exists, as expected. Its DLLs stopped loading after Windows XP. A Notify entry would not run on Windows 11 but would still mark tampering. |
How to Read It
Read Taskman and AppSetup in the Winlogon key. On a Remote Desktop server, Usrlogon.cmd in AppSetup is normal. List any Notify subkeys. On modern Windows these no longer run, but they still flag tampering. Cross check Shell and Userinit in the same key for added programs.
- When Windows Writes It
- When a value or Notify subkey is written.
- Which Windows Versions
- Windows XP to 11. Taskman runs only up to Windows Vista, and Notify only up to Windows XP and Server 2003.
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention. A hit shows the value set, not that it ran. Taskman and AppSetup are empty on a clean workstation.
// Writes to Taskman, AppSetup or a Notify subkey under WinlogonDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Winlogon Notify, Taskman and AppSetup shows.
- AmcacheGives the SHA-1 of a program named in Taskman or AppSetup.
- Process Starts at Logon, Security Event 4688Not in the RegistryShows whether anything listed actually ran at logon, as legacy entries may not.
Sources
The facts on this page come from these public pages, which say more on each point.
- Microsoft Learn: Winlogon and GINA (opens in a new tab)
- MITRE ATT&CK T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL (opens in a new tab)
- Geoff Chappell: Run program at startup as Taskman (opens in a new tab)
- Microsoft Learn: Logon script for Terminal Server users (opens in a new tab)