The modified Windows NT image loader will recognize this Win32k.sys as a SessionSpace-loadable image by a predefined bit set in the image header. The CSRSS process will also invoke the Winlogon (Winlogon.exe) process and the Win32k.sys (Window Manager and graphics device interface - GDI) kernel module under the newly associated SessionID. To create the idle sessions, the Session Manager executes the Windows NT-based client/server runtime subsystem process (Csrss.exe), and a new SessionID is assigned to that process. The Terminal Server service then calls the Windows NT Session Manager (Smss.exe) to create two (default = 2) idle client sessions (after creating the console session) that await client connections.

The console session starts as a normal Windows NT system session with the configured Windows NT display, mouse, and keyboard drivers loaded. The console (Terminal Server keyboard, mouse, and video) session is always the first to load, and is treated as a special-case client connection and assigned SessionID. Each process created within a session is 'tagged' with the associated SessionID to differentiate its namespace from any other connection's namespace. Each connection is given a unique session identifier or 'SessionID' to represent an individual session to the Terminal Server. This article describes the initialization process of a Terminal Server and describes what occurs when a user connects to the server and runs an application.Īpplies to: Windows Server 2012 R2 Original KB number: 186572 Windows Terminal Server InitializationĪs the Windows Terminal Server boots and loads the core operating system, the Terminal Server service (Termsrv.exe) is started and creates listening stacks (one per protocol and transport pair) that listen for incoming connections.

Windows 10 terminal services manager