Export (0) Print
Expand All

Window Station Security and Access Rights

Security enables you to control access to window station objects. For more information about security, see Access-Control Model.

You can specify a security descriptor for a window station object when you call the CreateWindowStation function. If you specify NULL, the window station gets a default security descriptor. The ACLs in the default security descriptor for a window station come from the primary or impersonation token of the creator.

To get or set the security descriptor of a window station object, call the GetSecurityInfo and SetSecurityInfo functions.

When you call the OpenWindowStation function, the system checks the requested access rights against the object's security descriptor.

The valid access rights for window station objects include the standard access rights and some object-specific access rights. The following table lists the standard access rights used by all objects.

ValueMeaning
DELETE (0x00010000L)Required to delete the object.
READ_CONTROL (0x00020000L)Required to read information in the security descriptor for the object, not including the information in the SACL. To read or write the SACL, you must request the ACCESS_SYSTEM_SECURITY access right. For more information, see SACL Access Right.
SYNCHRONIZE (0x00100000L)Not supported for window station objects.
WRITE_DAC (0x00040000L)Required to modify the DACL in the security descriptor for the object.
WRITE_OWNER (0x00080000L)Required to change the owner in the security descriptor for the object.

 

The following table lists the object-specific access rights.

Access rightDescription
WINSTA_ALL_ACCESS (0x37F)All possible access rights for the window station.
WINSTA_ACCESSCLIPBOARD (0x0004L)Required to use the clipboard.
WINSTA_ACCESSGLOBALATOMS (0x0020L)Required to manipulate global atoms.
WINSTA_CREATEDESKTOP (0x0008L)Required to create new desktop objects on the window station.
WINSTA_ENUMDESKTOPS (0x0001L)Required to enumerate existing desktop objects.
WINSTA_ENUMERATE (0x0100L)Required for the window station to be enumerated.
WINSTA_EXITWINDOWS (0x0040L)Required to successfully call the ExitWindows or ExitWindowsEx function. Window stations can be shared by users and this access type can prevent other users of a window station from logging off the window station owner.
WINSTA_READATTRIBUTES (0x0002L)Required to read the attributes of a window station object. This attribute includes color settings and other global window station properties.
WINSTA_READSCREEN (0x0200L)Required to access screen contents.
WINSTA_WRITEATTRIBUTES (0x0010L)Required to modify the attributes of a window station object. The attributes include color settings and other global window station properties.

 

The following are the generic access rights for the interactive window station object, which is the window station assigned to the logon session of the interactive user.

Access rightDescription
GENERIC_READ
STANDARD_RIGHTS_READ
WINSTA_ENUMDESKTOPS
WINSTA_ENUMERATE
WINSTA_READATTRIBUTES
WINSTA_READSCREEN
GENERIC_WRITE
STANDARD_RIGHTS_WRITE
WINSTA_ACCESSCLIPBOARD
WINSTA_CREATEDESKTOP
WINSTA_WRITEATTRIBUTES
GENERIC_EXECUTE
STANDARD_RIGHTS_EXECUTE
WINSTA_ACCESSGLOBALATOMS
WINSTA_EXITWINDOWS
GENERIC_ALL
STANDARD_RIGHTS_REQUIRED
WINSTA_ACCESSCLIPBOARD
WINSTA_ACCESSGLOBALATOMS
WINSTA_CREATEDESKTOP
WINSTA_ENUMDESKTOPS
WINSTA_ENUMERATE
WINSTA_EXITWINDOWS
WINSTA_READATTRIBUTES
WINSTA_READSCREEN
WINSTA_WRITEATTRIBUTES

 

The following are the generic access rights for a noninteractive window station object. The system assigns noninteractive window stations to all logon sessions other than that of the interactive user.

Access rightDescription
GENERIC_READ
STANDARD_RIGHTS_READ
WINSTA_ENUMDESKTOPS
WINSTA_ENUMERATE
WINSTA_READATTRIBUTES
GENERIC_WRITE
STANDARD_RIGHTS_WRITE
WINSTA_ACCESSCLIPBOARD
WINSTA_CREATEDESKTOP
GENERIC_EXECUTE
STANDARD_RIGHTS_EXECUTE
WINSTA_ACCESSGLOBALATOMS
WINSTA_EXITWINDOWS
GENERIC_ALL
STANDARD_RIGHTS_REQUIRED
WINSTA_ACCESSCLIPBOARD
WINSTA_ACCESSGLOBALATOMS
WINSTA_CREATEDESKTOP
WINSTA_ENUMDESKTOPS
WINSTA_ENUMERATE
WINSTA_EXITWINDOWS
WINSTA_READATTRIBUTES

 

You can request the ACCESS_SYSTEM_SECURITY access right to a window station object if you want to read or write the object's SACL. For more information, see Access-Control Lists (ACLs) and SACL Access Right.

 

 

Community Additions

ADD
Show:
© 2014 Microsoft