winsta0,session,desktop,winlogon,default_opendesktop winstat0\\desktop

A window station is an objectthat contains a clipboard, a set of global atoms and a group ofdesktop objects. Only one window station per session is permittedto interact with the user. This window station is named "Winsta0."Every window station belongs to a session. Session 0 is the sessionwhere services run and typically represents the console(pre-Vista). Any other sessions (Session 1, Session 2, etc) aretypically remote desktops / terminal server sessions, or sessionsattached to the console via Fast User Switching. So to summarize,sessions contain one or more window stations, and window stationscontain one or more desktops.

     You can picture the relationshipdescribed above as a tree. Below is an example of this desktop treeon a typical system:

- Session 0

| |

| ---- WinSta0 (interactive window station)

| | |

| | ---- Default (desktop)

| | |

| | ---- Disconnect (desktop)

| | |

| | ---- Winlogon (desktop)

| |

| ---- Service-0x0-3e7$ (non-interactive window station)

| | |

| | ---- Default (desktop)

| |

| ---- Service-0x0-3e4$ (non-interactive window station)

| | |

| | ---- Default (desktop)

| |

| ---- SAWinSta (non-interactive window station)

| | |

| | ---- SADesktop (desktop)

| |

- Session 1

| |

| ---- WinSta0 (interactive window station)

| | |

| | ---- Default (desktop)

| | |

| | ---- Disconnect (desktop)

| | |

| | ---- Winlogon (desktop)

| |

- Session 2

|

---- WinSta0 (interactive window station)

|

---- Default (desktop)

|

---- Disconnect (desktop)

|

---- Winlogon (desktop)

----to be continued