What is this hashed Session Name when I run qwinsta on my Win10 workstation?

Solution 1:

I HIGHLY suspect its Windows Remote Desktop listening for a connection as @harrymc pointed out. I can't explain why its hashed/worded-funny, however it IS odd its there if you have disabled Remote Desktop as you mentioned in a comment to harrymc's answer. However to confirm any suspicions run this command net stop termservice, after it's down my RDP 'Listen' session disappeared & I suspect your hashed one will as well. That'll make you feel better it's not malicious. I agree it SHOULDN'T be listening if you disabled it. Below is an article that can show you a bunch of things to check to confirm you really HAVE disabled it on the backend: https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/troubleshoot/rdp-error-general-troubleshooting

Solution 2:

The session with the hash-like name is in the "Listen" state.

The Microsoft article WTS_CONNECTSTATE_CLASS enumeration specifies the connection state of a Remote Desktop Services session, where is found this value:

WTSListen

The WinStation is listening for a connection. A listener session waits for requests for new client connections. No user is logged on a listener session. A listener session cannot be reset, shadowed, or changed to a regular client session.

It seems to me that what you see is an unconnected session, waiting and available for a connection by any user.

I can't see such a session when I fire up a Windows Server VM, so a further guess would be that perhaps this WinStation is a left-over from some user disconnecting from his session, but that's only a guess.