In Windows 2000, the !session extension displays one or more user sessions, or displays a specified process running in multiple user sessions.
In Windows XP and later versions of Windows, the !session extension controls the session context. It can also display a list of all user sessions.
Syntax in Windows 2000
!session [SessionID [2 Image]]
Syntax in Windows XP and later
!session !session -s DefaultSession !session -?
(Windows 2000 only) Specifies the session ID for the session to be displayed. If this is -1 or omitted, all sessions are displayed.
- 2 Image
(Windows 2000 only) Specifies the image name of a process. All processes with this name that belong to the session specified by SessionID are displayed. If Image is omitted, the csrss.exe process is displayed. Omitting this parameter is an easy way of listing all current user sessions, because every user session contains exactly one csrss.exe process.
- -s DefaultSession
(Windows XP and later) Sets the session context to the specified value. If DefaultSession is -1, the session context is set to the current session.
(Windows XP and later) Displays help for this extension in the Debugger Command window.
Windows XP and later
For information about user sessions and the Session Manager (smss.exe), see Microsoft Windows Internals, by Mark Russinovich and David Solomon.
This is really two different extensions. The !session extension in Windows 2000 is used to display information about a user session.
The !session extension in Windows XP and later versions of Windows is used to control the session context. Using !session with no parameters will display a list of active sessions on the target computer. Using !session /s DefaultSession will change the session context to the new default value.
When you set the session context, the process context is automatically changed to the active process for that session, and the .cache forcedecodeptes option is enabled so that session addresses are translated properly.
For more details and a list of all the session-related extensions that are affected by the session context, see Changing Contexts.
Build date: 11/16/2013