Windows station, desktop, and other concepts

In fact, you can query hdesk on msdn to find destop, window station, and other concepts.

The translation of msdn content has been roughly written, and may be incorrect.

Window station ):
Contains the clipboard (Clipboard), an atomic table, and one or more desktop objects. A window station is a protected object. When a window station is created, it is allocated to the current process and current session ).
The interactive window station winsta0 is the only window station that can display user interfaces and accept user input. It is allocated to the login session of the current user and contains the keyboard, mouse, and display, user interfaces and user input accepted cannot be displayed on other Windows sites.
When a user logs on to a terminal service computer, a session is started, and each session is allocated to its own interactive window station.

Desktop objects ):
A desktop object has a logical interface that contains user interface objects (such as Windows, menus, and hooks). It can be used to create and manage windows. Each desktop object is a protected object, when a desktop object is created, it is allocated to the window station where the current thread is located.
Messages can only be sent between processes on the same desktop. Therefore, the hook process can only receive messages on a specified desktop.
Each desktop object assigned to the winsta0 window station can display user interfaces and accept user input, but only one desktop object is active at the same time, you can use openinputdesktop and switchdesktop to obtain and switch between different desktops.
By default, there are three desktop objects in the winsta0 window station: default desktop (default), screen protection and login window (Winlogon), screen protection and login window is to protect the desktop. unprotected Screen Protection runs in winsta0 \ default.
The logon window (Winlogon) is activated when the user logs on. When the shell instructs the user to display the information, the system switches to the default desktop. when the user presses CTRL + ALT + DEL or the UAC dialog box is opened, the user switches to the login desktop.
The application cannot access and log on to the desktop, and the application cannot switch to the desktop when the login desktop is activated.

The system automatically creates an interactive window station. When a user logs on, the system can bind the interactive window station to a session. create a default desktop at the same time, you can use the createwindowstation function to create a new window station, createdesktop and createdomaintopex to create a desktop.
When a non-interface process (such as a service process) tries to connect to a window station, if no window station exists in the session where the process is located, the system will create a window station and a desktop in this session. The newly created window station name is based on the login session identifier. The desktop object name is described as follows:
If a service runs on LocalSystem and does not contain the service_interactive_process attribute, it uses the following window station and desktop: Service-0x0-3e7 $ \ default. this window station is non-interactive, so this service cannot display user interfaces and the processes it creates cannot display user interfaces.
If the service runs in the user security context, the name of the window station is based on the user Sid, 0xz1-z2 $, where z1 is the high address of the login Sid, and Z2 is the low address of the login Sid, the two services run in the same security context.

A process automatically connects to the window station and desktop when it calls the USER32 or GDI32 function for the first time. The system uses the following rules to determine the window station or desktop to which a process is connected:
1. If a process calls the setprocesswindowstation function, the process will be connected to the specified window station.
2. If the process does not call setprocesswindowstation, it will connect to the window Station of the parent process.
3. If the process does not call setprocesswindowstation or inherit the window Station of the parent process, the system opens the maximum_allowed access identifier and uses the following rules to connect to the window station:
If the window station name is written to startupinfo. lpdesktop when the process is created, the process is connected to the specified window station.
Otherwise, if the process runs in the login session of the interactive user, the process will be connected to the activated window site.
If the process runs in a non-interactive login session, the window site name is based on the login session identifier and tries to connect to the window site and desktop. if it does not exist, a window station and default desktop are created.

Connect a process to a window station:
The window station allocated to a process cannot be closed through closewindowstation.
When a process is connected to a window station, the system looks for the handle inherited by the process in the Process Handle table. The system uses the first window Station handle found. if you want a sub-process to connect to the inherited window station, you must ensure that only the desired handle is identified. if there are multiple inherited window station handles, the last connected window station is uncertain.
The handles opened in the window station cannot be inherited when a process is connected to a window station.

Connect a thread to a desktop:
After a process is connected to a window station, the system assigns a desktop to the thread. The system determines which thread the desktop is allocated according to the following rules:
1. If the thread calls setthreaddesktop, the thread is connected to the specified desktop.
2. If the thread does not call setthreaddesktop, it is connected to the desktop inherited by the parent process.
3. If the thread does not call setthreaddesktop and does not inherit the desktop, the system attempts to use the maximum_allowed permission and opens the desktop according to the following rules:
If the desktop name is specified in startupinfo. lpdesktop, the thread connects to the specified desktop.
Otherwise, the thread connects to the default desktop of the window station connected by the process.

The allocated desktop cannot be closed through closedesktop during connection.
When a process is connected to a desktop, the system queries the inherited handle in the Process Handle table. the system uses the first desktop handle to be found. If you want to connect a child to a specified desktop, make sure that only the desired handle is identified as inherited, if a sub-process inherits multiple desktop handles, the left side of the connection is uncertain.

The desktop handle opened by the system cannot be inherited when the process is connected to the desktop.