winsta0,session,desktop,winlogon,default

A window station is an object that contains a clipboard, a set of global atoms and a group of desktop objects. Only one window station per session is permitted to interact with the user. This window station is named "Winsta0." Every window station belongs to a session. Session 0 is the session where services run and typically represents the console (pre-Vista). Any other sessions (Session 1, Session 2, etc) are typically remote desktops / terminal server sessions, or sessions attached to the console via Fast User Switching. So to summarize, sessions contain one or more window stations, and window stations contain one or more desktops.

You can picture the relationship described above as a tree. Below is an example of this desktop tree on a typical system:

Windows会话，工作站，桌面的关系
│── Session 0
│   │── WinSta0 (interactive window station)
│   │   │── Default (desktop) 只有在Default桌面时，才能进行键盘的Input事件，UI自动化操作，
│   │   │── ScreenSaver (desktop) 断开连接或者是屏保桌面
│   │   └── Winlogon (desktop) 登录桌面，进行登录验证。
│   │── Service-0x0-3e7$ (non-interactive window station)
│   │   └── Default (desktop)
│   │── Service-0x0-3e4$ (non-interactive window station)
│   │   └── Default (desktop)
│   │── SAWinSta (non-interactive window station)
│   │   └── SADesktop (desktop)
│── Session 1
│   │── WinSta0 (interactive window station)
│   │   │── Default (desktop)
│   │   │── Disconnect (desktop)
│   │   └── Winlogon (desktop)
│── Session 2
│   │── WinSta0 (interactive window station)
│   │   │── Default (desktop)
│   │   │── Disconnect (desktop)
│   │   └── Winlogon (desktop)
...

Windows所有的用户交互操作都在seesion0下的winsta0下的几个桌面中。注意一下三点：

1. 同一时刻只能有一个桌面与用户进行交互（能接受鼠标，键盘输入），我们称之为InputDesktop
2. 我们的操作（即截图）只能在InputDesktop中才能生效。
3. 想在InputDesktop中进行有效操作的process需要一定的用户权限，普通进程无法进行有效操作。