First published on MSDN on Jul 17, 2012
Part of my
Sysinternals Primer: Gems
presentation at TechEd last month covered the topics of terminal services sessions, window stations and desktops. To illustrate the concepts, I used a utility I wrote called TSSessions. As promised, I have attached that utility (with source) to this blog post.
TSSessions reports four sets of information:
-
The TS session, window station and desktop on which the instance of TSSessions is running;
-
The current user input desktop in the current session;
-
Enumeration of all terminal services sessions, identifiying which is the console session;
-
Enumeration of window stations and desktops in the current TS session. The security descriptors of these objects are included in the output in
SDDL form
. Run TSSessions with the -NoSD command option to omit the security descriptors from the output.
Try running TSSessions under the System account; e.g., with "PsExec -sid cmd.exe". The System account has visibility into more details than even a regular administrative account has. Also try running TSSessions remotely in session 0 (PsExec -s cmd.exe), as I demonstrate in the Sysinternals talk. Here's some sample TSSessions output from the System account's non-interactive window station in session 0:
This process/thread running in:
Session 0
WinSta Service-0x0-3e7$
Desktop Default
Current user input Desktop: Incorrect function. (Error # 1 = 0x00000001)
Terminal Sessions: 3
Console Session = 1
Session ID: 0
Window Station Name : Services
State : Disconnected
WTS User Name :
No Token
Session ID: 1
Window Station Name : Console
State : Active
WTS User Name : Aaron
Token Logon Session : 00000000:000666b6
Token Integrity Level: Medium
Session ID: 65536
Window Station Name : RDP-Tcp
State : Listen
WTS User Name :
Window stations in the current session:
WinSta: WinSta0
Flags: 0x00000001
SID: (No user)
Desktop: Default
SID: (No user)
Desktop: Disconnect
SID: (No user)
Desktop: Winlogon
SID: (No user)
WinSta: Service-0x0-3e7$
Flags: 0x00000000
SID: (No user)
EnumDesktops error, Access is denied. (Error # 5 = 0x00000005)
WinSta: Service-0x0-3e4$
Flags: Access is denied. (Error # 5 = 0x00000005)
SID: Access is denied. (Error # 5 = 0x00000005)
EnumDesktops error, Access is denied. (Error # 5 = 0x00000005)
WinSta: Service-0x0-3e5$
Flags: Access is denied. (Error # 5 = 0x00000005)
SID: Access is denied. (Error # 5 = 0x00000005)
EnumDesktops error, Access is denied. (Error # 5 = 0x00000005)
TSSessions.zip
