Maybe an explination of how things SHOUD work would help.
Logon begins when the local session manager (Lsm.exe) runs for the first time and calls Winlogon.exe. Both Lsm and Winlogin are critical processes and the system will blue screen instantly if either stops running. Because Winlogin is critical you never get to actually see it, it calls LogonUI.exe as a child process and that presents you with the login box. The idea is if LogonUI crashes then Winlogin can restart it.
LogonUI handles the running of credential providers which by default are password or smartcard but developers can write their own.
Once a users details have been captured LogonUI will pass them to the local security authentication server process (LSASS.exe) and then close.
Once a users credentials have been verified LASS obtains an access token object that contains the users security profile. If you are an admin and UAC is enabled then a second restricted token is also generated and thats the one that gets used until you use ellivation.
The token is passed back to Winlogon which uses it to run Userinit.exe with the correct user details.
Userinit does some initialisation including running the logon script and then runs the user shell (usually explorer.exe) then it quits.
You will now see your desktop. Winlogon never quits and its always in the background waiting for someone to press CTL ALT DEL.
