Question is title, I can't find any information about what this session is. I googled 7a78855482a04 and got some random results mostly from a couple people that were wondering the same thing. I don't use remote management software or tools.
Any ideas?
Thanks so much for any information.
22 Answers
I HIGHLY suspect its Windows Remote Desktop listening for a connection as @harrymc pointed out. I can't explain why its hashed/worded-funny, however it IS odd its there if you have disabled Remote Desktop as you mentioned in a comment to harrymc's answer. However to confirm any suspicions run this command net stop termservice, after it's down my RDP 'Listen' session disappeared & I suspect your hashed one will as well. That'll make you feel better it's not malicious. I agree it SHOULDN'T be listening if you disabled it. Below is an article that can show you a bunch of things to check to confirm you really HAVE disabled it on the backend:
The session with the hash-like name is in the "Listen" state.
The Microsoft articleWTS_CONNECTSTATE_CLASS enumerationspecifies the connection state of a Remote Desktop Services session, where is found this value:
WTSListen
The WinStation is listening for a connection. A listener session waits for requests for new client connections. No user is logged on a listener session. A listener session cannot be reset, shadowed, or changed to a regular client session.
It seems to me that what you see is an unconnected session, waiting and available for a connection by any user.
I can't see such a session when I fire up a Windows Server VM, so a further guess would be that perhaps this WinStation is a left-over from some user disconnecting from his session, but that's only a guess.
8
