!!! Overview
[{$pagename}] identifies the the [Dynamic-Link Library] ([DLL]) loaded and used by the[Local Security Authority] ([LSA]) along with configuration information stored in the [Windows registry].
Loading multiple [{$pagename}]s permits the [LSA] to support multiple logon processes and multiple security [protocols].

%%warning
[LSA Protection] prevents unsigned [{$pagename}]s from being loaded.
%%

[Windows Logon] use [{$pagename}] to analyze logon data by following the rules and procedures set forth in a security protocol.

[{$pagename}] are responsible for the following tasks:

* Analyzing logon [data] to determine whether a security principal is allowed to [Access] a system or [Resource].
* Establishing a new logon [session] and creating a unique logon identifier for the successfully authenticated principal.
* Passing security information to the [LSA] for the principal's security [token].

[{$pagename}]s provide [Authentication Mechanism] services by implementing package-specific functionality for the LsaLogonUser and LsaCallAuthenticationPackage functions provided by the [LSA].

After a [Windows Logon] session is created and associated with a [principal], subsequent [authentication] requests made on behalf of the [principal] are handled differently than the initial logon. The [{$pagename}] does not create a new [Windows Logon] session nor return information for creating a [token]. The [{$pagename}] can, however, associate supplemental [credentials] obtained during a subsequent [authentication] with the principal's existing [Windows Logon] session. Supplemental [credentials] are obtained when access to a requested resource requires information beyond the [credentials] established by the initial [Windows Logon].

Msv1_0.dll is an [example] of a [{$pagename}] which accepts a user name and a [Hashed|One-Way Hash Function] [password], which it looks up in the [Security Account Manager] ([SAM]) [database]. Depending on the results of the lookup, the MSV1_0 [{$pagename}] accepts or rejects the authentication attempt.%%zebra-table
%%sortable
%%table-filter
||Component||Description
|Credssp.dll|Operates with [CredSSP] and is the default dynamic-link library (DLL) module that operates in the security context of [Winlogon].
|Netlogon.dll|Some of the services that [Netlogon service] performs include:\\maintains the computer’s [Schannel SSP] to a [Domain Controller].\\[Netlogon service] passes the user’s [credentials] through a [Secure connection] channel to the [Domain Controller] and returns the [AD DOMAIN] [SIDs] and user [Permissions] for the user.\\ Publishes service resource records in the [Domain Name System] ([DNS]) and uses [DNS] to resolve names to the [Internet Protocol] ([IP Address]) of [Domain Controllers].
|Msv1_0.dll| Operates with the [NTLM SSP] which uses [NTLM] [Authentication Method] [protocol]. [Extended Protection for Authentication] is enabled using the [Channel Binding] [token].
|Schannel.dll|Operates with the [Schannel SSP] and provides [Secure Socket Layer] ([SSL]) and [Transport Layer Security] ([TLS]) [authentication] [protocol]. This [protocol] provides [Mutual Authentication] over an encrypted channel.
|Kerberos.dll|Operates with the [Kerberos SSP] which uses [Kerberos] V5 authentication protocol. This protocol provides authentication using Kerberos protocol. [Extended Protection for Authentication] is enabled using the [Channel Binding] token.
|Wdigest.dll|Operates with the [Digest SSP] providing a Simple [Challenge-response Authentication Mechanism]  that provides increased security over [Basic Authentication Scheme]. [Extended Protection for Authentication] is enabled using the [Channel Binding] [token]. For information about Extended Protection in Digest, see Digest Authentication Processes and Interactions.
|Pku2u.dll|The [PKU2U] [SSP] enables [Peer-to-peer] [authentication], particularly through the Windows 7 media and file sharing feature called Homegroup, which permits sharing between computers __that are not members of a domain__.
|Negoexts.dll|Operates with the [Negotiate SSP] to provide an method that negotiates the use of [SSPs] for applications and scenarios implemented by [Microsoft] and other software companies.
|Lsasrv.dll|The [Local Security Authority Subsystem Service] ([LSASS]), which both enforces security [policies|Politics] and acts as the security package manager for the [LSA].
|Samsrv.dll|The [Security Account Manager] ([SAM]), which stores__ local security accounts__, enforces locally stored policies, and supports [APIs].
|Secur32.dll|The authentication provider that exposes the [Security Support Provider] ([SSP]) interfaces to applications.
/%
/%
/%

!! [Windows Event Log]
[{$pagename}] is shown in the [Windows Event Log] fields within the [Windows Logon] process that only provides a "__hint__" at how the user tried to access the system.

If the logon was to a Windows resource and authenticated via [Kerberos], the [{$pagename}] field would list "[Kerberos]". 

at its console, through Server Message Block (SMB) or Common Internet File System (CIFS) for shared-folder access, or through IIS. Some logon processes are authentication-protocol specific as shown in the chart below.

* [Winlogon] - Windows Logon Process
* [Schannel SSP] - Secure connection such as SSL
* KSecDD - Kernel Security Device Driver - A [kernel]-mode [Software library] of functions that implement the advanced [Local Procedure Call] (ALPC) interfaces that other [Kernel] mode security components, including the Encrypting File System (EFS), use to communicate with [LSASS] in user mode. KSecDD refers to the name of the file for this [Software library] which is in %SystemRoot%\System32\Drivers\Ksecdd.sys.
* Secondary Logon Service - [Run As]
* [IKE] - [Internet Key Exchange]
* HTTP.SYS - is a [web] [server] for ASP.NET Core that only runs on Windows.
* SspTest -  Test program for the [NTLM SSP] service.
* dsRole - Directory Service function
* DS Replication - Directory Service function
* CredProvConsent - (user account control)
* [NTLM SSP] - Might also be [Anonymous] [authentication]
* advapi - implies it was a Web-based logon as IIS processes [Windows Logon] through the advapi Logon Process shows as [MICROSOFT_AUTHENTICATION_PACKAGE_V1_0]

!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Chapter 5 Logon/Logoff Events|https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter5|target='_blank'] - based on information obtained 2020-04-27 
* [#2] - [Authentication Packages|https://docs.microsoft.com/en-us/windows/win32/secauthn/authentication-packages|target='_blank'] - based on information obtained 2020-05-21