Vista Feb CTP contains service session 0 mitigation code. Cool!

If you're an IT Pro or a developer, you've probably taken an interest in the new session seperation in Windows Vista. This is the new design in Windows Vista that moves users out of "session 0" and reserves session 0 for services and drivers. Unfortunately, this means that a common "shortcut" that many developers used to take no longer works. In the past, devs could simply pop stuff up from their services on "WinSta0\Default" and know that it would appear on your screen (as long as you weren't on a terminal server).

Now though Vista has introduced a very terminal server like environment as a security enhancement. User sessions start with session 1 and will increment as you use "Switch User" or logoff and on. Services, like the nulls that they are, still hang out in session 0 all by themselves. Services like Symantec's Anti-Virus product (and many others) will need to be re-written to be able to pop UI up on the user's screen. Microsoft has seen that this can be a real problem for some vendors and even some LOB applications, so they have shimmed it in the most recent build of Vista (the Feb CTP or build 5308). For example, see what Vista now shows when SAV detects a virus and pops up their UI on session 0:

This allows the user to very easily access that session 0 info without exposing any other session 0 UI and without incurring a security risk. When I clicked "Check request...", I then got taken to a session 0 desktop like this:

Here, we can interact with the Symantec UI even though Symantec has not released a real Vista compliant version of their AV product yet. The same would hold true for services that your companies may have developed.

This seems to be a fairly elegant bridging technology to allow users applications to still work, while being enough of a pain that their vendors will definitely hear about it. All the while maintaining the session seperation and security.

Kudos to Microsoft for this design.

Follow Me on Twitter