(i'm not a windows api hacker, so i have no idea how relevant the following links are. apologies if i'm posting junk...)

LSA authentication: LINK

lsalogonuser: LINK

SECURITY_LOGON_TYPE: LINK

winlogon and gina: LINK

windows 2000 security event descriptions (non-MSDN): LINK

audit logon events: LINK

winxp pro system event id's: LINK