When a windowstation is created, the engine is called with the windowstation handle and a list of display devices that are to be used in the windowstation. The engine initializes the devices and retains the windowstation handle so that when a DC is created for a display, it can be assigned to the proper windowstation. When a function that reads the screen contents is used, the engine calls the USER32 server with the DC's windowstation to determine the allowed access.
The access WINSTA_READSCREEN must be granted to a process in order to read the contents of a display screen with the following operations:
GetPixel() when the DC is a display context.
BitBlt() and StretchBlt when the source DC is a display context and the destination DC is used and is not a display context.