Server Keyboard

When the Terminal Server starts its booting process, it initiates with loading the core operating system. After loading it, the Terminal Server service will start working and will create listening stacks which will listen for incoming connections.

Terminal Server will recognize every connection with a unique session identifier. This unique session identifier can be named as SessionID. To distinguish between the namespaces, every process created within a session is marked with its associated SessionID. The console session means the loading of Terminal Server keyboard, mouse and video. This session is considered as a special-case client connection and allocated a SessionID. This console session is completed in the initiation. It initiates as a normal Windows NT system session, in which the assembled Windows NT display, mouse and keyboard drivers are loaded.

• After this, Terminal Server service demands the Windows NT Session Manager to create two idle sessions after creating the console session.
• After completing this, it will start waiting for the client connections.
• For creating the idle sessions, the Session Manager has to run the Windows NT-based client/server runtime subsystem process.
• Then a new SessionID is assigned to that process.
• In the newly associated SessionID, Winlogon process and the Win32k.sys kernel module will be invoked.
• Then the Windows NT image loader will distinguish this Win32k.sys as a Session Space-loadable image.

If Win32k.sys has not already been loaded, then Windows NT image loader has to perform the task of relocating the code portion of the image into physical memory. After this, the data part of that image is assigned to the new session. In the console session drivers for keyboard and mouse are loaded simultaneously but in the Terminal Server Client sessions, drivers for the display, keyboard and mouse are loaded separately.

In this process, mouse and keyboard communicate into the stack with the use of multiple instance stack manager known as termdd.sys.

Wdtshare.sys is the RDP driver and will receive messages from termdd.sys about the mouse and keyboard activity.  This process makes the RDP client session interactive.  Then in the last, Terminal Server Support will demand a connection listener thread for the RDP protocol. This thread will be managed by the termdd.sys, which listens for RDP client connections.