I added some more undocumented API’s to my Jwawinsta unit, the unit is now becoming a collection of the undocumented API’s in winsta.dll.
These are the functions I added:
- WinStationDisconnect
- WinStationGetProcessSid
- CachedGetUserFromSid (exported by utildll.dll)
- Session State
- WinStationName
- SessionId
- ConnectTime
- DisconnectTime
- LastInputTime
- LogonTime
- OutgoingFrames
- OutgoingBytes
- OutgoingCompressedBytes
- IncomingCompressedBytes
- IncomingFrames
- IncomingBytes
- Domain
- Username
- CurrentTime
I would like know how it is possible to access WindowStation and Desktops from a service.
CreateDesktop and similar only works for the current session of the process.
I know there exists NTQueryObject and similar but they are hard to understand and only query kernel objects.
However creating a desktop from a service into another session is a mystery.
The only way I know of is to spawn a process into the session of your choice and let it create a desktop.
However this can produce risky security holes because we would need a communication which could be overheard.
Chris, it's not possible AFAIK to have multiple Window Stations in a Terminal Session. I had a look at Winlogon and termsrv.dll but I could not find anything that could help you on this matter.