Session Types

Updated 761 Days AgoPublic

Actions

Sessions in Windows are . . . weird. For example:

• There's a flag that marks a session as being a "Terminal Services" session that is set if someone logs in via RDP. That will persist even if they disconnect from that RDP session but leave it running. However, if you log in via SSH, even within that RDP session, that SSH session is not a "Terminal Services" session.

Upstream docs:

• https://learn.microsoft.com/en-us/windows/win32/api/ntsecapi/ne-ntsecapi-security_logon_type
  • https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types