Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Grzegorz Tworek Profile picture
@0gtweet
Jul 23, 2024 • 1 tweets • 1 min read • Read on X
Reading how inaccurate and confident these posts are at the same time I would add something to this one as well. Winlogon doesn't launch Taskmgr.exe for ~16 years. When you press Ctrl+Shift+Esc, Winlogon launches LaunchTM.exe, which launches Taskmgr.exe. It's not the same.

Image
Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Grzegorz Tworek

Grzegorz Tworek Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @0gtweet

Grzegorz Tworek Profile picture
Sep 16, 2023
As no one knew a working example, I had to weaponize GPO Extensions on my own 😎
The practice is a bit harder than just dropping a DLL and new key in Winlogon\GPExtensions. I believe there is a simpler way, but this one works. Unfortunately it requires AD connectivity.
A 🧵⤵ Image
1. Create the DLL exporting PFNPROCESSGROUPPOLICY callback function, as defined at
2. "return 0" is enough for the code.
3. The real code can be put into DllMain(), of course it works.
4. Make a key in Windows NT\CurrentVersion\Winlogon\GPExtensions.learn.microsoft.com/en-us/windows/…
5. The key name has to be a GUID. Non-GUID keys are ignored.
6. Within the key, two REG_SZ values should exist:
- DllName - pointing to the DLL
- ProcessGroupPolicy - containing the exported callback name from the DLL
7. Go to Windows\CurrentVersion\Group Policy\History
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(