How windows authentication works in background?

This authentication method is a preferred solution for small and medium network environments. Users will have to authenticate when accessing web sites. The credentials are verified against an external Server acting as a Domain Controller. This can be a: Windows NT 4.0 Server or Windows 2000/2003/2008 Server (even with Active Directory enabled). Samba 2.x / 3.x Server (running as Domain Controller). Advanced Proxy works with Windows integrated authentication (transparent) or with standard authentication (explicit with username and password).

initially IIS performs the authentication through one of its authentication options (e.g., basic, digest, Integrated Windows, or some combination of them). After successful authentication, IIS passes the credentials of the authenticated user to the ASP.NET thread. Selection of appropriate identity for the ASP.NET worker thread is performed by using the process defined under the ASP.NET Impersonation section. Based on the credentials supplied by IIS, windows identity is created by WindowsAuthenticationModule module in ASP.NET. This identity is set as current user identity (setting the security information for the current HTTP request)for the application. This is the default authentication mode in ASP.NET and it is set in web.config file of the application

Winlogon Winlogon (%windir%\System32\Winlogon.exe) is the executable file responsible for managing secure user interactions. Winlogon initiates the logon process for Windows Server 2003, Windows 2000, Windows XP, and Windows NT 4.0. Winlogon is responsible for the following tasks. Desktop lockdown Standard SAS recognition SAS routine dispatching User profile loading Screen saver control Multiple network provider support