9.6 Closing an Object

When an object is closed, the system audits the event. Depending on the object type other processing is performed:

WindowStation Windowstations are only closed and destroyed by the USER32 windowstation control thread when commanded to do so by the System Manager.
Desktop The desktop's open count is decremented. If it drops to zero, the desktop and all windows, menus and DDE conversations contained in the desktop are destroyed.
Window The window is destroyed and by doing this the window handle is rendered invalid.
Menu The menu is destroyed and by doing this the menu handle is rendered invalid.
DDE Access All conversations are terminated and the access handle is rendered invalid.
DDE Conversation The conversation is terminated and the conversation handle is rendered invalid.

If the object is destroyed as a result of its being closed, the object's SD is dereferenced and retention checks are performed.