Session 0 Isolation Explained

Wednesday, 02 May 2007 by Michel Roth

As some of you may know, Windows Vista and Longhorn Server introduced a new concept in relation to the session IDs used. In Windows 2003 all services ran in a session 0 (zero). This was also referred to as the "console". You can log on to the console by running the RDP client with the /console option. The fact that this allowed users (administrators) to be in the same session with the system services opened up a window of attack. In Windows Vista and Longhorn Server, Microsoft tried to close this Window with something called Session 0 Isolation. The Windows Performance Team goes to explain (pretty in-depth):

"The Microsoft Windows Vista operating system mitigates this security risk by isolating services in Session 0 and making Session 0 non-interactive. In Windows Vista (and Windows Longhorn Server), only system processes and services run in Session 0. The user logs on to Session 1. On Windows Longhorn Server, subsequent users log on to subsequent sessions (Session 2, Session 3 etc). This means that services never run in the same session as users' applications and are therefore protected from attacks that originate in application code. "

Read it here.