会话、工作站（Session workstation）.docVIP

会话、工作站（Session workstation） A system can log in to multiple users (including remote user login) A user has a session (a remote user is called a remote session) A session has multiple workstations and windows. Can only have an interactive workstation (Winsta0). A session has a series of private processes and modules: Csrss.exe, WinLogin.exe, Lsass.exe, and Win32k.sys A session has a private object namespace (\BaseNamedObjects), and the kernel object in the namespace of the private object cannot be accessed by other sessions. An interactive workstation has at least three desktops: the default desktop, the landing desktop, and the screensaver desktop A non interactive workstation that has at least one desktop A desktop has 0-N windows (a desktop in a non interactive workstation can have no windows) A desktop that interacts with the user has a Explorer.exe process The window must be bound to a desktop Windows cannot cross desktop access Windows user login process Before Windows starts, only the system and smss.exe processes are present before the first user lands. System is the system process, and smss.exe is the session manager process, which is responsible for user login and logout management. These two processes are part of the system user process. When a session is logged in, smss.exe creates csrss.exe and winLogin.exe and loads win32k.sys. Csrss.exe is the client server run subsystem process, and WinLogin.exe is the login process. Win32k.sys is the client server runtime subsystem kernel module. Csrss.exe will manage all the processes and threads created by that session (it will have handles for these processes and threads to receive relevant notifications and send notifications to them. Send an exit notice to the user as they log out. WinLogin.exe will also be responsible for important duties during the work. WinLogins responsibilities are as follows: Initialize the Winsta0 workstation. (this is the first workstation, and the only interactive workstation in the ses