The interactive window station, Winsta0, is the only window station that can display a user interface or receive user input. All other window stations are noninteractive.
Each session is associated with its own interactive window station.
When a user logs on to a Remote Desktop Services–enabled computer, a session is started for the user. Each session is identified by a unique session ID.
Window Station and Desktop Creation:
The system automatically creates the interactive window station.When an interactive user logs on, the system associates the interactive window station with the user logon session. The system also creates the default input desktop for the interactive window station (Winsta0\default).
When a noninteractive process such as a service application attempts to connect to a window station and no window station exists for the process logon session, the system attempts to create a window station and desktop for the session.
LocalSystem account without SERVICE_INTERACTIVE_PROCESS attribute: window station and desktop: Service-0x0-3e7$\default
in the security context of a user account,
A desktop is a securable object contained within a window station. A desktop has a logical display surface and contains user interface objects such as windows, menus, and hooks.
When a desktop is created, it is associated with the current window station of the calling process and assigned to the calling thread.
Window messages can be sent only between processes that are on the same desktop.
This active desktop, also known as the input desktop, is the one that is currently visible to the user and that receives user input.
By default, there are three desktops in the interactive window station: Default, ScreenSaver, and Winlogon.