Take the 2-minute tour ×

If I enumerate sessions using LsaEnumerateLogonSessions() to give me a list of session LUIDs then LsaGetLogonSessionData() to get details of each session (as described on MSDN) then on Windows XP it behaves exactly as I would expect, showing one logged-on session for me plus some logons for services.

Running the same program on Windows 7 shows two logon sessions for me, plus the service sessions. The two sessions for me show up as the same user and the same logon time.

I was running some elevated processes so I thought that might be it, but the second session is still there when I close those down and even after a reboot. So does anyone know why there is a second session for each real logged-on user? How can you tell which is the "real" one?



share|improve this question
add comment

1 Answer

Some quick googling seems to indicate that Windows 7 (and probably Vista before it) creates two logon sessions for administrative users when UAC is enabled - one elevated and one not.

share|improve this answer
Yes, that's about the size of it. A non admin user gets just one session, but an admin user gets two. What I don't see is how to find out which is the "normal" session and which has been created for elevated use. Any ideas? They look exactly the same in the struct returned by LsaGetLogonSessionData(), apart from the session LUID. –  Tim Haynes Feb 14 '11 at 15:53
I'm not really familiar with this area, but the only thing I could see from a few minutes of reading the docs is querying a token for TokenStatistics or TokenOrigin; this returns the logon session id from which the token originated. So you could get one of the tokens (either the full or restricted) and get its logon session; then the other logon session would correspond to the other token. –  Luke Feb 14 '11 at 17:52
add comment

Your Answer


