The other day I was looking at a bsod crash dump of my Windows 7 x64 laptop and I noticed interestingly enough that there were many instances of LogonUI.exe in the process list.
Now LogonUI.exe is what it says, it implements the user interface for typing in your user name and password. If you write a Credential Provider, LogonUI.exe is the process you would be interacting with. You will be getting loaded into LogonUI and getting queried for user credentials. Note that this mechanism is instead of replacing msgina.dll in pre-Vista Windows.
Generally if you are lucky, you could find at most two1 LogonUIs running on your system. LogonUI.exe is launched in only when there is a need for it like when you are about to login after a boot or when you have locked your machine. When I am logged in and working, most of the time I do not see an instance of LogonUI.exe running. So why so many of them on my machine ?!
Here is a truncated output from Windbg when I listed all LogonUI.exe processes.
