intermediate

Window stations & desktops

The session-side objects that organize visible desktops, input, and GUI isolation.

Guided paths in this branch

Follow a short sequence step by step. Each path links to the first topic; use Read next on each page to continue.

Official Microsoft docs

Closest official references related to this topic on Microsoft Learn.

Why it matters

These objects explain secure desktops, Session 0 isolation, and why not every process can just show UI to every user.

Mental model

A window station is the container; a desktop is the currently visible or hidden workspace inside that container.

How it works

  1. 1Each interactive user session is associated with an interactive window station, commonly Winsta0.
  2. 2That window station contains desktops such as Winlogon, Default, and ScreenSaver.
  3. 3Threads attach to a desktop, and only the active input desktop receives visible user interaction.

Key terms

Winsta0
The interactive window station for a logged-on session.
Input desktop
The currently active desktop that receives user input.

A service that cannot display a dialog to the user

Because services live in Session 0, they are not attached to the logged-in user's interactive desktop and cannot reliably present UI there.

Common misconception

A desktop is not just wallpaper and icons. It is a securable GUI object with its own windows, hooks, and access rules.

You should read next

Ranked from your current topic, related links, branch depth, and any active guided path.

Related topics