WindowsAppSDK: Immediate crash when trying to run as a different user

Describe the bug

App crashes during load when run as a different user than the one to whom the Terminal Services session belongs.

Steps to reproduce the bug

Install Visual Studio 2022 version 17.2.3.
Restart the computer.
On the Windows sign-in screen sign-in to User A.
Install Windows App SDK C++ VS2022 Templates extension version 1.1.0.76285337.
Install the Windows App SDK Runtime version 1.1.0 x64 (WindowsAppRuntimeInstall-1.1.0-x64.exe).
Start Visual Studio.
Create a new project using the instructions at the following page: https://docs.microsoft.com/en-us/windows/apps/winui/winui3/create-your-first-winui3-app#non-msix-packaged-create-a-new-project-for-a-non-msix-packaged-c-or-c-winui-3-desktop-app
1. Use the Blank App, Packaged (WinUI 3 in Desktop) template.
2. Add <WindowsPackageType>None</WindowsPackageType> to the .vcxproj.
3. Modify <AppxPackage>true</AppxPackage> to <AppxPackage>false</AppxPackage>
4. Run using the Unpackaged launch profile and make sure everything works.
Locate the EXE and launch it in a variety of other ways - double click in Windows Explorer, launch using full path in PowerShell, execute (F6) in WinDbg, etc. - and see that they all work.
Sign out of the TS session or lock it (🪟+L).
Back in the Windows sign-in screen sign-in to User B.
Install the same WindowsAppRuntimeInstall-1.1.0-x64.exe from above.
Launch the EXE in all the ways mentioned in section 8 and verify that they all work.
Sign out of the TS session or lock it.
Back again in the Windows sign-in screen sign-in to User A again.
From the TS session of User A run the EXE as User B in any of the following ways and note that it crashes in them all:
1. From Windows Explorer, hold shift and right click on the EXE, select Run as a different user,
2. If User A is not an administrator and User B is, right click and select Run as administrator.
3. Launch PowerShell/cmd as a User B and launch the EXE from there.
4. Run WinDbg as User B, and launch the EXE from there.


Microsoft (R) Windows Debugger Version 10.0.22621.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: D:\repos\App5\App5\x64\Debug\App5\App5.exe

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*D:\Symbols\Microsoft*http://msdl.microsoft.com/download/symbols
REDACTED

************* Path validation summary **************
Response                         Time (ms)     Location
REDACTED
Symbol search path is: REDACTED
Executable search path is: 
ModLoad: 00007ff7`87b50000 00007ff7`87cce000   App5.exe
ModLoad: 00007ffa`e0300000 00007ffa`e0509000   ntdll.dll
ModLoad: 00007ffa`dfd20000 00007ffa`dfddd000   C:\WINDOWS\System32\KERNEL32.DLL
ModLoad: 00007ffa`dd7f0000 00007ffa`ddb69000   C:\WINDOWS\System32\KERNELBASE.dll
ModLoad: 00007ffa`dfe20000 00007ffa`e0198000   C:\WINDOWS\System32\combase.dll
ModLoad: 00007ffa`ddec0000 00007ffa`ddfd1000   C:\WINDOWS\System32\ucrtbase.dll
ModLoad: 00007ffa`9cc90000 00007ffa`9ccbb000   C:\WINDOWS\SYSTEM32\VCRUNTIME140D.dll
ModLoad: 00007ffa`df590000 00007ffa`df6b0000   C:\WINDOWS\System32\RPCRT4.dll
ModLoad: 00007ffa`6daa0000 00007ffa`6db83000   C:\WINDOWS\SYSTEM32\MSVCP140D.dll
ModLoad: 00007ffa`ded20000 00007ffa`dedf6000   C:\WINDOWS\System32\OLEAUT32.dll
ModLoad: 00007ffa`c0f30000 00007ffa`c0f3f000   C:\WINDOWS\SYSTEM32\VCRUNTIME140_1D.dll
ModLoad: 00007ffa`ddfe0000 00007ffa`de07d000   C:\WINDOWS\System32\msvcp_win.dll
ModLoad: 00007ffa`6d050000 00007ffa`6d271000   C:\WINDOWS\SYSTEM32\ucrtbased.dll
ModLoad: 00007ffa`9cb10000 00007ffa`9cb44000   D:\repos\App5\App5\x64\Debug\App5\Microsoft.WindowsAppRuntime.Bootstrap.dll
ModLoad: 00007ffa`dfb80000 00007ffa`dfd1a000   C:\WINDOWS\System32\ole32.dll
ModLoad: 00007ffa`dea80000 00007ffa`deaa9000   C:\WINDOWS\System32\GDI32.dll
ModLoad: 00007ffa`ddc30000 00007ffa`ddc56000   C:\WINDOWS\System32\win32u.dll
ModLoad: 00007ffa`de080000 00007ffa`de192000   C:\WINDOWS\System32\gdi32full.dll
ModLoad: 00007ffa`def70000 00007ffa`df11c000   C:\WINDOWS\System32\USER32.dll
ModLoad: 00007ffa`de950000 00007ffa`de9fe000   C:\WINDOWS\System32\ADVAPI32.dll
ModLoad: 00007ffa`deec0000 00007ffa`def63000   C:\WINDOWS\System32\msvcrt.dll
ModLoad: 00007ffa`e0200000 00007ffa`e029e000   C:\WINDOWS\System32\sechost.dll
ModLoad: 00007ffa`de1a0000 00007ffa`de94f000   C:\WINDOWS\System32\SHELL32.dll
(8cb0.740c): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffa`e03dd114 cc              int     3
0:000> g
ModLoad: 00007ffa`dfde0000 00007ffa`dfe11000   C:\WINDOWS\System32\IMM32.DLL
ModLoad: 00007ffa`dde40000 00007ffa`ddebf000   C:\WINDOWS\System32\bcryptPrimitives.dll
D:\a\_work\1\s\BuildOutput\Release\x64\WindowsAppRuntime_DLL\WindowsAppRuntimeInsights.h(53)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB224DB: (caller: 00007FFA9CB1E1C6) LogHr(1) tid(740c) 8007007E The specified module could not be found.
    Msg:[Unable to load resource dll. Microsoft.WindowsAppRuntime.Insights.Resource.dll] 
ModLoad: 00007ffa`dc9a0000 00007ffa`dc9b8000   C:\WINDOWS\SYSTEM32\kernel.appcore.dll
ModLoad: 00007ffa`dee00000 00007ffa`deeaf000   C:\WINDOWS\System32\clbcatq.dll
ModLoad: 00007ffa`d3250000 00007ffa`d3384000   C:\Windows\System32\AppXDeploymentClient.dll
ModLoad: 00007ffa`d3d60000 00007ffa`d3f4f000   C:\WINDOWS\SYSTEM32\urlmon.dll
ModLoad: 00007ffa`d3d30000 00007ffa`d3d58000   C:\Windows\System32\srvcli.dll
ModLoad: 00007ffa`dc440000 00007ffa`dc44c000   C:\Windows\System32\netutils.dll
ModLoad: 00007ffa`d3a70000 00007ffa`d3d23000   C:\Windows\System32\iertutil.dll
ModLoad: 00007ffa`be890000 00007ffa`be980000   C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 00007ffa`db7b0000 00007ffa`db916000   C:\WINDOWS\SYSTEM32\wintypes.dll
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(776)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B0D9: (caller: 00007FFA9CB19C2F) LogHr(2) tid(740c) 80040010 Object is not in any of the inplace active states
    Msg:[Bootstrap.Intitialize: Scanning packages for Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0] CallContext:[\Initialize] 
ModLoad: 00007ffa`d3420000 00007ffa`d343b000   C:\WINDOWS\SYSTEM32\windows.staterepositorycore.dll
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(865)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B85C: (caller: 00007FFA9CB19C2F) LogHr(3) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.485.2229.0-x6-p3_1000.485.2229.0_x64__8wekyb3d8bbwe not applicable. Version doesn't match MinVersion criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(865)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B85C: (caller: 00007FFA9CB19C2F) LogHr(4) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.485.2229.0-x8-p3_1000.485.2229.0_x86__8wekyb3d8bbwe not applicable. Version doesn't match MinVersion criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(885)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1BB5E: (caller: 00007FFA9CB19C2F) LogHr(5) tid(740c) 80040012 Not able to perform the operation because object is not given storage yet
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x6_1000.516.2156.0_x64__8wekyb3d8bbwe is applicable (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(876)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1B9F8: (caller: 00007FFA9CB19C2F) LogHr(6) tid(740c) 80040011 Not able to convert object
    Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x8_1000.516.2156.0_x86__8wekyb3d8bbwe not applicable. Architecture doesn't match current architecture x64 (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0)] CallContext:[\Initialize] 
D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp(908)\Microsoft.WindowsAppRuntime.Bootstrap.dll!00007FFA9CB1C486: (caller: 00007FFA9CB19C2F) LogHr(7) tid(740c) 80040013     Msg:[Bootstrap.Intitialize: Microsoft.WinAppRuntime.DDLM.1000.516.2156.0-x6_1000.516.2156.0_x64__8wekyb3d8bbwe best matches the criteria (Major.Minor=1.1, Tag=, MinVersion=1000.516.2156.0) of 118 packages scanned] CallContext:[\Initialize] 
ModLoad: 00007ffa`ac030000 00007ffa`ac0fa000   C:\WINDOWS\System32\twinui.appcore.dll
ModLoad: 00007ffa`db920000 00007ffa`dc188000   C:\WINDOWS\System32\Windows.Storage.dll
ModLoad: 00007ffa`cceb0000 00007ffa`cd6c6000   C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
ModLoad: 00007ffa`dec30000 00007ffa`ded1a000   C:\WINDOWS\System32\shcore.dll
ModLoad: 00007ffa`acca0000 00007ffa`acda4000   C:\WINDOWS\SYSTEM32\daxexec.dll
ModLoad: 00007ffa`dce60000 00007ffa`dce89000   C:\WINDOWS\System32\USERENV.dll
ModLoad: 00007ffa`c1ff0000 00007ffa`c2033000   C:\WINDOWS\System32\container.dll
ModLoad: 00007ffa`d84a0000 00007ffa`d84b7000   C:\WINDOWS\SYSTEM32\usermgrcli.dll
onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(332)\daxexec.dll!00007FFAACD41F38: (caller: 00007FFAACD4154D) Exception(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
(8cb0.740c): C++ EH exception - code e06d7363 (first chance)
(8cb0.740c): C++ EH exception - code e06d7363 (first chance)
onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(113)\daxexec.dll!00007FFAACD570E1: (caller: 00007FFAACD1D3FF) ReturnHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    Msg:[onecore\base\appmodel\execmodel\desktopappx\lib\aamextensions.cpp(332)\daxexec.dll!00007FFAACD41F38: (caller: 00007FFAACD4154D) Exception(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
] CallContext:[\TryActivateDesktopAppXApplication] 
onecore\base\appmodel\execmodel\desktopappx\desktoplib\desktopaamextensions.cpp(170)\daxexec.dll!00007FFAACD1D428: (caller: 00007FFAAC05C412) LogHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
onecore\base\appmodel\execmodel\desktopappx\desktoplib\desktopaamextensions.cpp(203)\daxexec.dll!00007FFAACD1D5CD: (caller: 00007FFAAC05C412) ReturnHr(2) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
    CallContext:[\TryActivateDesktopAppXApplication] 
onecoreuap\shell\twinui\activation\lib\applicationactivationmanagerproxy.cpp(90)\twinui.appcore.dll!00007FFAAC05C435: (caller: 00007FFA9CB19E34) ReturnHr(1) tid(740c) 80070520 A specified logon session does not exist. It may already have been terminated.
(8cb0.740c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrap_StopActivity+0x93:
00007ffa`9cb24403 88050d230100    mov     byte ptr [Microsoft_WindowsAppRuntime_Bootstrap!_tlgEvent+0xf (00007ffa`9cb36716)],al ds:00007ffa`9cb36716=00
0:000> k
 # Child-SP          RetAddr               Call Site
00 0000004f`a496d940 00007ffa`9cb248ff     Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrap_StopActivity+0x93 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrapTracelogging.cpp @ 15] 
01 0000004f`a496da10 00007ffa`9cb1d2d1     Microsoft_WindowsAppRuntime_Bootstrap!wilResultLoggingThreadCallback+0x20f [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrapTracelogging.cpp @ 143] 
02 0000004f`a496dad0 00007ffa`9cb26313     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ThreadFailureCallbackFn<bool (__cdecl&)(wil::FailureInfo const &) noexcept>::NotifyFailure+0x11 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1085] 
03 (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure+0xa0 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1040] 
04 0000004f`a496db00 00007ffa`9cb1428e     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::GetContextAndNotifyFailure+0xc3 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result.h @ 1100] 
05 (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::LogFailure+0xed [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3522] 
06 0000004f`a496db30 00007ffa`9cb14410     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_NoReturn<0>+0x12e [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3669] 
07 0000004f`a496f030 00007ffa`9cb1447f     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_Base<0,0>+0x30 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3705] 
08 0000004f`a496f090 00007ffa`9cb14498     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::ReportFailure_Hr<0>+0x5f [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 3866] 
09 0000004f`a496f110 00007ffa`9cb1a092     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::in1diag3::_Throw_Hr+0x18 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 5630] 
0a (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!wil::details::in1diag3::Throw_IfFailed+0x257 [D:\a\_work\1\s\packages\Microsoft.Windows.ImplementationLibrary.1.0.210930.1\include\wil\result_macros.h @ 5662] 
0b 0000004f`a496f160 00007ffa`9cb18ede     Microsoft_WindowsAppRuntime_Bootstrap!CreateLifetimeManagerViaEnumeration+0x4e2 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 616] 
0c (Inline Function) --------`--------     Microsoft_WindowsAppRuntime_Bootstrap!CreateLifetimeManager+0x13b [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 555] 
0d 0000004f`a496f430 00007ffa`9cb18453     Microsoft_WindowsAppRuntime_Bootstrap!FirstTimeInitialization+0x1fe [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 343] 
0e 0000004f`a496f5e0 00007ffa`9cb18128     Microsoft_WindowsAppRuntime_Bootstrap!_MddBootstrapInitialize+0x53 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 204] 
*** WARNING: Unable to verify checksum for App5.exe
0f 0000004f`a496f620 00007ff7`87c28e6c     Microsoft_WindowsAppRuntime_Bootstrap!MddBootstrapInitialize2+0x2e8 [D:\a\_work\1\s\dev\WindowsAppRuntime_BootstrapDLL\MddBootstrap.cpp @ 129] 
10 0000004f`a496f860 00007ff7`87c28d94     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::AutoInitialize::Initialize+0x6c [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 75] 
11 0000004f`a496fa00 00007ff7`87babc07     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::AutoInitialize::AutoInitialize+0x24 [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 32] 
12 0000004f`a496fb00 00007ffa`6d1022a3     App5!Microsoft::Windows::ApplicationModel::DynamicDependency::Bootstrap::`dynamic initializer for 'g_autoInitialize''+0x27 [D:\repos\App5\App5\packages\Microsoft.WindowsAppSDK.1.1.0\include\MddBootstrapAutoInitializer.cpp @ 82] 
13 0000004f`a496fc00 00007ff7`87c44819     ucrtbased!_initterm+0x63 [minkernel\crts\ucrt\src\appcrt\startup\initterm.cpp @ 22] 
14 0000004f`a496fc40 00007ff7`87c4477e     App5!__scrt_common_main_seh+0x89 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 258] 
15 0000004f`a496fcb0 00007ff7`87c44aae     App5!__scrt_common_main+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 331] 
16 0000004f`a496fce0 00007ffa`dfd354e0     App5!wWinMainCRTStartup+0xe [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_wwinmain.cpp @ 17] 
17 0000004f`a496fd10 00007ffa`e030485b     KERNEL32!BaseThreadInitThunk+0x10
18 0000004f`a496fd40 00000000`00000000     ntdll!RtlUserThreadStart+0x2b

Expected behavior

Program running.

Screenshots

NuGet package version

1.1.0

Packaging type

Unpackaged

Windows version

Windows 11 version 21H2 (22000)

IDE

Visual Studio 2022

About this issue

Original URL
State: open
Created 2 years ago
Comments: 25 (10 by maintainers)

Most upvoted comments

In my case on a normal dekstop session, with no terminal services involved, event viewer logs the following error:

<EventData>
  <Data>Windows App Runtime</Data>
  <Data>ERROR 0x80070520: Bootstrapper initialization failed while looking for version 1.1 (MSIX package version >= 1002.543.1943.0)</Data>
</EventData>

Balkoth on Jul 19, 2022

Is it relevant that this happens on a terminal session? I can see it crash when trying to run an unpackaged app from a normal desktop session as different user. It also crashes when trying to run as admin which is supposed to work with 1.1 onwards. So what is going on here?

That’s just the term. I never said it was a remote session.

In the context of users and programs run by those users there are two things called “a session”.

One of them is logon sessions, which represent a login for the purposes of permissions (including by a service account, or a login for SMB), are the basis for tokens, are represented by the SEP_LOGON_SESSION_REFERENCES struct and can be enumerated with LsaEnumerateLogonSessions.

The other one is Terminal Services sessions which represent a physical connection a console†, local or remote, used by Remote Desktop Services and Fast User Switching. They can be enumerated by the WTSEnumerateSessions function, where WTS stands for Windows Terminal Services. Certain information about them is published via the WM_WTSSESSION_CHANGE windows message, where again WTS stands for the same thing.

Each token is linked to a specific Terminal Services session, and while the member of the TOKEN struct that identifies the session is called simply SessionId rather than the lengthy MicrosoftWindowsTerminalServicesSessionId (as is the member of the MM_SESSION_SPACE struct etc.), WinDbg’s !token command does use the term “TS session”. Once more “TS” stands for Terminal Services.

0: kd> !token ffffd50c6602a060
_TOKEN 0xffffd50c6602a060
TS Session ID: 0
User: S-1-5-18
User Groups:
 00 S-1-16-16384
    Attributes - GroupIntegrity GroupIntegrityEnabled
...

0: kd> dt nt!_TOKEN ffffd50c6602a060
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER 0x06207526`b64ceb90
   +0x030 TokenLock        : 0xffff8887`f1245210 _ERESOURCE
   +0x038 ModifiedId       : _LUID
   +0x040 Privileges       : _SEP_TOKEN_PRIVILEGES
   +0x058 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x078 SessionId        : 0
...

0: kd> !token ffffd50c75adb7f0
_TOKEN 0xffffd50c75adb7f0
TS Session ID: 0x1
User: S-1-5-21-3728847233-3017425221-756437700-1001
User Groups:
 00 S-1-16-0
    Attributes - GroupIntegrity GroupIntegrityEnabled
...

0: kd> dt nt!_TOKEN ffffd50c75adb7f0
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER 0x7fffff36`d5969fff
   +0x030 TokenLock        : 0xffff8887`f817be90 _ERESOURCE
   +0x038 ModifiedId       : _LUID
   +0x040 Privileges       : _SEP_TOKEN_PRIVILEGES
   +0x058 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x078 SessionId        : 1
...

This term is used throughout Windows.

Here, since the processes run under different users, using different logon sessions, but in the same TS session, it was appropriate to qualify the term so as to reduce confusion. “Two processes in different logon session running in the same session” is undoubtedly worse than “two processes in different logon sessions running in the same Terminal Services session.”

“Normal desktop session” isn’t a thing. It’s unclear and suggests the question are there abnormal desktop sessions. There’s an existing term and I simply used it.

It also crashes when trying to run as admin which is supposed to work with 1.1 onwards. So what is going on here?

Programming is hard and not everyone is equally qualified or able to do it adequately.

† Except in the special case of session 0 since Windows Vista. Vista leverages the security boundary formed by TS session (in the Object Manager etc.) to separate certain system processes from user processes and protect them. That Windows XP gave the first user that logs on to the machine access to the “global namespace” it just odd and that was fixed in Vista.

conioh on Jul 19, 2022