\registry\machine\software\microsoft\windows nt\currentversion\winlogon
    SfcDisable = REG_DWORD 0x00000000
    SfcScan = REG_DWORD 0x00000002
    SfcQuota = REG_DWORD 0x00000032
    SfcBugcheck = REG_DWORD 0x00000000
    SfcDebug = REG_DWORD 0x00000000

\registry\machine\software\microsoft\windows nt\currentversion\winlogon\notify\Sfc
    Asynchronous = REG_DWORD 0x00000001
    Impersonate = REG_DWORD 0x00000000
    DllName = REG_EXPAND_SZ sfc.dll
    Logoff = SfcWLEventLogoff
    StartShell = SfcWLEventLogon

\registry\machine\software\microsoft\windows nt\currentversion\image file execution options\winlogon.exe
    debugger = ntsd -d -lines -g