What are all these window stations and desktops in Session 0 anyway?
Now that we know how to tweak the sizes of session view space and the
varIoUs desktops,it is worth talking about why you have so many
window stations and desktops,particularly in session 0. First off,
you’ll find that every WinSta0 (interactive window station) has at
least 3 desktops,and each of these desktops uses varIoUs amounts of
desktop heap. I’ve alluded to this prevIoUsly,but to recap,the
three desktops for each interactive window stations are:
· Default desktop – desktop heap size is configurable as
described below
· Disconnect desktop – desktop heap size is 64k on 32-bit
systems
· Winlogon desktop – desktop heap size is 128k on 32-bit
systems
Note that there can potentially be more desktops in WinSta0 as well,
since any process can call CreateDesktop and create new desktops.
Let’s move on to the desktops associated with non-interactive window
stations: these are usually related to a service. The system creates
a window station in which service processes that run under the
LocalSystem account are started. This window station is named
service-0x0-3e7$. It is named for the LUID for the LocalSystem
account,and contains a single desktop that is named Default. However,
service processes that run as LocalSystem interactive start in Winsta0
so that they can interact with the user in Session 0 (but still run in
the LocalSystem context).
Any service process that starts under an explicit user or service
account has a window station and desktop created for it by service
control manager,unless a window station for its LUID already exists.
These window stations are non-interactive window stations. The window
station name is based on the LUID,which is unique for every logon.
If an entity (other than System) logs on multiple times,a new window
station is created for each logon. An example window station name is
“service-0x0-22e1$”.