How to debug WinLogon.exe?

You can use the GFlags.exe application to enable debugging options for Window Login application.

GFlags.exe ships with the Windows Debugging tools. (Get Windows Debugging Tools here.)

Run the GFlags.exe and check the options: Debug WinLOGON, Enable debugging of Win32 SubSystem and Debug initial command.

This results in running the Winlogon in the Windows Symbolic Debugger (Ntsd.exe) with the -d parameter, which directs its output to the kernel debugger console. (Refer http://technet2.microsoft.com/WindowsServer/en/library/6a183942-57b1-45e0-8b4c-c546aa1b8c471033.mspx?mfr=true for more details)

Note that you should setup a kernel mode debugging session for this to be effective.