Description

The INTERACT_WITH_DESKTOP option specifies whether or not user processes are allowed to interact with the current console logon session.

INTERACT_WITH_DESKTOP is applicable only when the LOGON_METHOD option is set to interactive. (If LOGON_METHOD is set to batch, the established security context already disallows all interaction with the desktop.)

Usage

Values

option is the specification for whether or not user processes can interact with the current logon session.

Valid values for option are:

• yes
  User processes run in a context that permits the current interactive console session to interact with them. This interaction can go both ways, as the process may invoke system functions that access desktop elements (for example: Windows, menus, and buttons) associated with the session. This is considered a security risk, in that it creates an opportunity for a malicious process to hijack the desktop. If the security context of the interactive session is higher than that of the process, the process could invoke code using an elevated security context.
• no
  User processes run in a context that is isolated from the current interactive logon session. Unless user processes requiring user interaction are executed, this is the recommended value.

Default is no.