title: Sessions, Window stations and Desktops
body: <p>Sessions, Window Stations and Desktops.</p>
  
  <blockquote>
    <p>A session consists of all process and
    other system objects that represent a
    single user's logon session. Sessions
    contain Window Stations and Window
    Stations contain desktops.</p>
  </blockquote>
  
  <p>The above is from <a href="http://blogs.technet.com/b/askperf/archive/2007/07/24/sessions-desktops-and-windows-stations.aspx" rel="noreferrer">http://blogs.technet.com/b/askperf/archive/2007/07/24/sessions-desktops-and-windows-stations.aspx</a></p>
  
  <p>(Similar articles say the same thing, e.g. blogs.technet.com/b/askperf/archive/2007/04/27/application-compatibility-session-0-isolation.aspx and blogs.msdn.com/b/ntdebugging/archive/2007/01/04/desktop-heap-overview.aspx)</p>
  
  <p>I've always understood Sessions and logon sessions to be one and the same thing.</p>
  
  <p>However, reading p. 474, Russinovich and Solomon, Windows Internals, 5th edition, it says (penultimate paragraph):</p>
  
  <blockquote>
    <p>The CreateProcessWithLogon function
    also creates a token by creating a new
    logon session with an initial process,
    which is how the Runas command
    launches processes under alternative
    tokens.</p>
  </blockquote>
  
  <p>So Runas creates a new logon session. If we use Runas to run Notepad under a different user's credentials we see it appear on the desktop. So Notepad is running on the same desktop as everything else. (This is, as far as I understand it, the default desktop in Window Station Winsta0; the interactive window station.) So what we have now are <em>two</em> logon sessions associated with the same Session (the thing that contains window stations). So Sessions and logon sessions would not appear to be one and the same.</p>
  
  <p>Can anybody confirm this please?</p>
  
  <p>Confused</p>