0

I was able to get the Window Station Handle from the IIS process and get the name "Service-0x0" with GetUserObjectInformation. Similarly, when I got the Desktop Handle from the thread and got the name, I got "Desktop". I think there is a windowing station in the service for session 0, and no desktop. Why does it exist?

IntPtr hWinSta = GetProcessWindowStation();
IntPtr hDesktop =  GetThreadDesktop(GetCurrentThreadId());

GetUserObjectInformation(hWinSta, ...
GetUserObjectInformation(hDesktop, ...
llscsrl
  • 59
  • 6
  • 1
    There is a desktop, it is just not visible. How using it is risky on older Windows versions is detailed in [this web page](https://web.archive.org/web/20150320041430/http://blogs.technet.com/b/askperf/archive/2007/07/24/sessions-desktops-and-windows-stations.aspx) – Hans Passant Nov 01 '21 at 08:16

1 Answers1

2

The desktop is still there. The reason it is still there is because it is required to create windows (HWNDs) and for various APIs to function (SetWindowsHookEx etc.). The Session 0 isolation was added in Vista and too many legacy services exist to be able to fully remove the window station and desktop, these services rely on too many functions in USER32 and GDI32.

In Vista you could actually switch to the Session 0 desktop if Windows detected that a interactive service required UI input but I don't think this feature exists in current Windows versions.

Anders
  • 97,548
  • 12
  • 110
  • 164
  • Thank you for your answer. I see. It does exist. I'm using Windows Servier 2019. Am I right in thinking that I can get it but the desktop in session 0 is a non-interactive desktop and I can't switch between them? – llscsrl Nov 02 '21 at 06:35
  • That is what MSDN claims, yes. I don't remember when the session 0 switch service was removed. – Anders Nov 02 '21 at 11:15