WM_QUERYENDSESSION

[=?ISO-8859-1?Q?Ulf_Jaenicke-R=F6=DFler?=]

Hi,

while it works quite well to intercept the power button by catching
the WM_POWEBROADCAST message I would like to be able to do some
action if the user ends his session by means of StartButton-Shutdown.

This is normally very easy: just listen to WM_QUERYENDSESSION.
But with my current image I cannot seem to get this message.
I use Minlogon - is this a known problem? Or is there a system-wide
setting I need to change?
What else could I do to get notified of a shutdown?

Thanks,
Ulf

 

[KM]

Ulf,

How do you shotdown your runtime?
I think normally, ExitWindowsEx sends out the WM_QUERYENDSESSION mesasge.
Try to call the API from your app and see if it works on your runtime.

KM

 

[=?ISO-8859-1?Q?Ulf_Jaenicke-R=F6=DFler?=]

Hi,

Ulf,

How do you shotdown your runtime?

Actually we have a shell application which the user can use to shutdown.
Furthermore the user may push the power button.
Both methods work fine. However, if the user decides to run Explorer as
shell (it was a requirement to make that possible) he could use the
Start button menu to shutdown.
This too works quite well on Win2k and XP Pro, but on XPe there is no
WM_QUERYSESSION :-(

I think normally, ExitWindowsEx sends out the WM_QUERYENDSESSION mesasge.

That's what I think too.

Try to call the API from your app and see if it works on your runtime.

I wrote a little app that simply calls ExitWindowsEx (without EWXFORCE, of
course) - no WM_QUERYENDSESSION either :-(
BTW, xpepm -restart doesn't help as well.

Thank you for helping,
Ulf

 

[KM]

Ulf,

I don't know what it the problem with WM_QUERYENDSESSION.
It would be good to know if it gets fired at all.
Add a handler for WM_ENDSESSION too. This way you will know if session end
message routine works on Minlogon at all.

However, the problem may be in receving the event in Minlogon image. Since
you are running under Local System account, the rules are a bit different.
Also, there is no real order control to catch the event (unless you set a
global hook on the message). So some other app (even Minlogon) can sit and
catch the message returning FALSE (0) and therefore canceling the session
end (the system stops sending WM_QUERYENDSESSION messages as soon as one
application returns zero).

Anyway, what you can do is try adding your application-defined
HandlerRoutine function (through SetConsoleCtrlHandler API) and catch
CTRL_SHUTDOWN_EVENT signal from system (shutdown of the system). By the
signal you can do whatever you need to do. But you may not be able to cancel
the shutdown, though.

Also, related to both approaches (WM_QUERYENDSESSION and
SetConsoleCtrlHandler), you can play with SetProcessShutdownParameters API
to set a different shutdown priority (level) for your process. Don't know if
it will make any difference on your image but may be worth to try.

KM

 

[=?ISO-8859-1?Q?Ulf_Jaenicke-R=F6=DFler?=]

I don't know what it the problem with WM_QUERYENDSESSION.
It would be good to know if it gets fired at all.

Well, I wanted to catch that by Spy++ - but it hangs on Shutdown :-(

Add a handler for WM_ENDSESSION too. This way you will know if session end
message routine works on Minlogon at all.

Tried that already - without success.

However, the problem may be in receving the event in Minlogon image. Since
you are running under Local System account, the rules are a bit different.
Also, there is no real order control to catch the event (unless you set a
global hook on the message). So some other app (even Minlogon) can sit and
catch the message returning FALSE (0) and therefore canceling the session
end (the system stops sending WM_QUERYENDSESSION messages as soon as one
application returns zero).

Hmmm - I found this in the SDK:
"Applications running in the system security context do not get shut down by
the operating system. They get notified of shutdown or logoff through the
callback function installable via SetConsoleCtrlHandler. They also get notified
in the order specified by the dwLevel parameter."

which emphasizes the "system security context" - which is exactly what you
pointed to. So I'll try SetConsoleCtrlHandler and see if it will work.
Furthermore I could try the global hook aproach - I have one anyway.
If I can't stop the shutdown I will be able to (at least) commit EWF buffer
or alike.
I'll write here about the progress (hopefully).

Your help has once again proven very valuable - thanks!

Ulf

 

[=?ISO-8859-1?Q?Ulf_Jaenicke-R=F6=DFler?=]

pointed to. So I'll try SetConsoleCtrlHandler and see if it will work.

This works quite well now. Although I cannot stop the Shutdown, I'm able to
do the final work, when the user shuts down via start menu or even by means
of "shutdown -l" in a console window.

The only thing that cannot be intercepted is "xpepm" shutdown or restart
(I guess it uses NtShutdownSystem very straight, because this behaves similar),
but I can live with it. In fact I would rather call this a feature

Regards
Ulf

 

[KM]

Ulf,

I am glad SetConsoleCtrlHandler worked for you.

In some sense, it is definitely a better way than catching the WM_QUERYENDSESSION (without a global hook).