GUI & windowing
Sessions, desktops, USER/GDI objects, and the Windows-specific UI machinery above the core kernel.
Guided paths in this branch
Follow a short sequence step by step. Each path links to the first topic; use Read next on each page to continue.
GUI & session UI
Understand sessions, window stations, desktops, USER/GDI objects, and the CSRSS/Win32k plumbing behind the shell.
Step 1 of 4 in this path
Official Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
This is the part of Windows that most people touch all day but rarely map correctly. It explains why a logged-in session, a desktop, a window, and the shell are related but not the same thing.
Mental model
The GUI stack is not just 'Explorer'. Windows builds interactive sessions, attaches them to window stations and desktops, and then manages windows, menus, drawing, and input through dedicated subsystems.
Schematic
Interactive session
A logon creates an interactive session with its own core UI plumbing. This is where Winlogon, Explorer, and per-session GUI state comes to life.
Windows building blocks
Names and paths you can look for in Task Manager, Explorer, or documentation.
- Processexplorer.exe
Shell and desktop
- Componentwin32k.sys / win32kbase.sys
Kernel windowing
Go one level deeper
Extra detail for readers who want more precision before opening a child topic.
- GDI drawing can be hardware-accelerated via DXGI/DWM composition for desktop apps.
- Session disconnect keeps processes alive while releasing the interactive desktop.
How it works
- 1A user session is created and connected to an interactive window station.
- 2That window station contains desktops such as Winlogon and Default.
- 3Processes in the session create USER and GDI objects that represent windows, menus, cursors, fonts, and drawing state.
Key terms
- Window station
- A securable object containing desktops plus shared GUI resources like the clipboard and atom table.
- Desktop
- A logical display and input surface that contains windows, menus, and hooks.
- USER/GDI
- Core GUI object families for interface elements and graphics resources in Windows.
Why UAC or Ctrl+Alt+Del changes what you see
Windows can switch the visible desktop inside the same session, which is why the secure logon or consent UI feels like a separate environment rather than just another window.
Common misconception
The desktop is not the shell and the shell is not the whole GUI system. Explorer sits on top of deeper session, windowing, and graphics infrastructure.
Go deeper
Window stations & desktops
The session-side objects that organize visible desktops, input, and GUI isolation.
USER & GDI objects
Windows, menus, cursors, device contexts, fonts, bitmaps, and the resource model behind the GUI.
CSRSS, Win32k, and session UI plumbing
How user-mode session infrastructure and kernel-side windowing pieces cooperate.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
Window stations & desktops
The session-side objects that organize visible desktops, input, and GUI isolation.
Next step in your guided path
intermediate
USER & GDI objects
Windows, menus, cursors, device contexts, fonts, bitmaps, and the resource model behind the GUI.
Go deeper in this branch
expert
CSRSS, Win32k, and session UI plumbing
How user-mode session infrastructure and kernel-side windowing pieces cooperate.
Go deeper in this branch
Related topics
Session Manager, Winlogon, and the shell
The early user-mode path from system process creation to an interactive desktop.
Processes & threads
How Windows represents work, isolates applications, and schedules execution.
Services & background infrastructure
How Windows launches, groups, isolates, and supervises long-running background components.