I did some tests with giving sessionname (eg RDP-
Tcp#20) as 2nd parameter, doesn't seem to work. Then I tried with servername, if I specify either computername or
IP then remote control works. My tests so far where all on a single server, so this parameter makes it possible to shadow a session on another server. This is probably needed because as Olli determined WinSta actually calls _RpcWinStationShadow. So servername is needed for the RPC part, hServer is probably needed to send the user a message ("domain\user wants to remote control, do you accept?").
So this is it:
function WinStationShadow(hServer:
Handle; pServerName: PWideChar; SessionID: ULONG; HotKey: ULong; HKModifier: ULong): Boolean; stdcall;
Tested this with a remote server and it works! For local server you can supply Empty String or Nil that's why it working with ULONG 0.
So could param 3 for WinStationShadowStop also be Servername?
I will also have to test WinStationConnectW as the Unknown ULONG there could also be Servername.