Description
!logonsession browses the nt!SepLogonSessions variable to extract and list the existing logon sessions.
According to https://web.archive.org/web/20241227071828/https://techcommunity.microsoft.com/blog/askds/using-debugging-tools-to-find-token-and-session-leaks/400472 ,
The SepLogonSessions pointer points to not just a list, but an array of lists. These lists are made up of _SEP_LOGON_SESSION_REFERENCES structures.
SepLogonSessions is used as a (very simple) hash list.
In our code we do something more simple (SepLogonSessions being just directly a list of _SEP_LOGON_SESSION_REFERENCES structures), which is "ok" per se – our code works --, but isn't what WinDbg would expect.