Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.
For this API to work you must have the Interactive Services Detection (UI0Detect) service running.
The signatures are:
procedure WinStationSwitchToServicesSession; stdcall; external 'winsta.dll';
procedure WinStationRevertFromServicesSession; stdcall; external 'winsta.dll';Since these procedures require no arguments we can also call them from the commandline:
rundll32 winsta.dll,WinStationSwitchToServicesSessionWhen you switch to the services desktop you will automatically get a Dialog Box that enables you to Return to the normal desktop (this just calls WinStationRevertFromServicesSession).
Or you can manually return with this commandline:rundll32 winsta.dll,WinStationRevertFromServicesSession;