Enum Winsta GUI
Window Stations and Desktops Explorer

Enum Winsta GUI displays list of window stations and desktops on your Windows NT computer and allows to change their properties.

1. Features

With Enum Winsta GUI you can: Right-click on window station or desktop name opens context menu that contains list of possible actions.

2. Limitations

2.1. Windows 95/98 Are Not Supported

Enum Winsta GUI will not run on Windows 95/98.
There is no point running Enum Winsta GUI on Windows 95/98 anyway, because Windows 95/98 do not support window stations and desktops. Enum Winsta GUI runs on Windows NT 4.0 SP4 or higher, and on Windows 2000. On Windows NT 4.0 new security editors (AclUI.DLL) is required.

2.2. Inaccessible Window Stations

Enum Winsta GUI displays only those window stations for which your user accountt has WINSTA_ENUMERATE right. Therefore, it is possible that some "invisible" window stations exist. Windows NT does not have documented way of displaying all window stations regardless of WINSTA_ENUMERATE right.

Furthermore, if you remove WINSTA_ENUMERATE right from a windows station, it becomes "invisible" to you and there is no way to return it back to view, except for rebooting the computer.

2.3. Inaccessible Desktops

Desktop is accessible only if you have WINSTA_ENUMDESKTOPS right for the parent window station. You can enable or disable this right using security editor built into Enum Winsta GUI.

2.4. Take Ownership

In case of window stations and desktops, Windows NT does not provide documented means for taking ownership on objects for which you don't have any access at all. Therefore, take ownership does not always work.

2.5. Switch To Desktop

Switch to desktop feature works only for desktops of WinSta0 window station. This limitation is by design. In Windows NT only desktops of WinSta0 can be displayed on the physical screen.

2.6. Creating Window Stations and Desktops

Sometimes when you create window station or desktop, it disappears when you exit and restart Enum Winsta GUI application. This behavior is by design. In Windows NT object (window station, desktop, event, semaphore, etc.) is automatically removed when last handle to the object is closed. When you create window station or desktop object, Enum Winsta GUI holds open handle to the object until the end of the program. When Enum Winsta GUI program exits all its handles are automatically closed. If no other program references window station or desktop object in question, the object will be automatically removed by Windows NT. To prevent this you may run cmd.exe on the desktop in question. For window station you will have to create a desktop and run cmd.exe on that desktop.

2.7. Access to Winlogon Desktop

It seems that in order to open Winlogon desktop, one needs DESKTOP_READOBJECTS and DESKTOP_WRITEOBJECTS rights, even if they are not specified in AccessMask parameter of OpenDesktop(). This is unique for Winlogon - all other desktops behave properly with OpenDesktop. Since even administrators normally don't have those rights on Winlogon desktop, it can normally be opened only by LocalSystem account.

3. Running Enum Winsta GUI Under LocalSystem Account

You will have much less restricted access to Enum Winsta GUI if you run it under LocalSystem account. To do so, use Keith Brown's CmdAsUser tool from www.develop.com/kbrown/security/samples.htm, or su.exe from Windows NT Resource Kit.

4. To Do List

  1. If there are too many window stations and desktops and the tree view must be scrolled, tree view jumps to the end of list every time it is refreshed. This may be very frustrating. Although, on a typical system it is unlikely that there are so many window stations and desktops that they don't fit in the window.
  2. Undocumented NT API (NtQueryDirectoryObject???) allows to list all window stations, even those on which caller does not have WINSTA_ENUMERATE right. These functions are used by WinObj utility from www.sysinternals.com.
  3. Find a way to take ownership on inaccessible desktops/window stations.