rwinsta.exe

• File Path: C:\WINDOWS\system32\rwinsta.exe
• Description: Reset Session Utility

Hashes

Type	Hash
MD5	F35FB1D94CBEF97FE7E411C51D2604F6
SHA1	C68E2D1B4696F3C3B3627B6B6462FB9B8759EBC1
SHA256	508F5509EB4ADC95CF1D205B7D67643455F944042AF024C398FC430DA88C190C
SHA384	331D5929794D8EA3C6E52D2457315E6B68D7AFB8E9602899883C529588F02D3F0AE7200B9DB1CE05BF54D2DF4B8DBDF6
SHA512	AEBADAC26C1466F223F0AAFFC531C77424A07C598BC2599C485A8369530F47B8C82E158B20735ADE482EB210B375EB01FF5794A0BCFC7BAE9D90D84F204FD396
SSDEEP	768:dYpFNLAsoqSn7Pi5DWQF+tzoQmpp7lmue:dYXtAson+T2Nue
IMP	ACE7E1CA440DD0C4C63E4D2682CA6E8B
PESHA1	9930EA565B7BB4D198C17A526D7C041B7276805F
PE256	A67D6137FEC4E0267FF2945392D13DF8DD66FF42CA2EEC3E01F9A9F027D49F26

Runtime Data

Usage (stdout):

Reset the session subsytem hardware and software to known initial values.

RESET SESSION {sessionname | sessionid} [/SERVER:servername] [/V]

  sessionname         Identifies the session with name sessionname.
  sessionid           Identifies the session with ID sessionid.
  /SERVER:servername  The server containing the session (default is current).
  /V                  Display additional information.

Usage (stderr):

Invalid parameter(s)
Reset the session subsytem hardware and software to known initial values.

RESET SESSION {sessionname | sessionid} [/SERVER:servername] [/V]

  sessionname         Identifies the session with name sessionname.
  sessionid           Identifies the session with ID sessionid.
  /SERVER:servername  The server containing the session (default is current).
  /V                  Display additional information.

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\rwinsta.exe

Signature

• Status: Signature verified.
• Serial: 33000002ED2C45E4C145CF48440000000002ED
• Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
• Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
• Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

• Original Filename: rwinsta.exe.mui
• Product Name: Microsoft Windows Operating System
• Company Name: Microsoft Corporation
• File Version: 10.0.22000.1 (WinBuild.160101.0800)
• Product Version: 10.0.22000.1
• Language: English (United States)
• Legal Copyright: Microsoft Corporation. All rights reserved.
• Machine Type: 64-bit

File Scan

• VirusTotal Detections: 0/72
• VirusTotal Link: https://www.virustotal.com/gui/file/508f5509eb4adc95cf1d205b7d67643455f944042af024c398fc430da88c190c/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

---

rwinsta

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Resets (deletes) a session on a Remote Desktop Session Host server.

[!NOTE] This command is the same as the reset session command.

[!NOTE] To find out what’s new in the latest version, see What’s New in Remote Desktop Services in Windows Server.

Additional References

• reset session

• Command-Line Syntax Key

• Remote Desktop Services (Terminal Services) Command Reference

---

MIT License. Copyright (c) 2020-2021 Strontic.