Sign in with
Sign up | Sign in
Your question

NT service: terminated after user logoff

Last response: in Windows 2000/NT
Share
February 1, 2005 2:15:10 PM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

Hello, all.

I have written a NT service that uses Winsock.
This works fine until I logoff. When logoff happenes, the service just
dies without much clue. System event log shows that "the service
terminated unexpectedly..."

The service is running under "Local System" account and "Allow service
to interact with desktop" is NOT checked.

Has anyone encountered similar problem?
Your knowledge sharing is really appreciated.

Thanks in advance.

Kaky
Anonymous
February 1, 2005 5:39:51 PM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

"mustang" <kakyung@hotmail.com> wrote in message
news:5f390e01.0502011115.51bfe213@posting.google.com...
> I have written a NT service that uses Winsock.

OK.

> This works fine until I logoff. When logoff happenes, the service just
> dies without much clue. System event log shows that "the service
> terminated unexpectedly..."

This is an educated guess:

Does you service create any windows? Are they visible when the user logs
off? If you are using boilerplate code (MFC, etc) for the shell of your
service then it may be that that when your window is closed at loggof, the
boilerplate's WM_CLOSE message handler (or perhaps the WM_ENDSESSION
handler) does a DestroyWindow() on your main window which causes a
WM_DESTROY message whose handler does a PostQuitMessage(0) which terminates
the application. That would be bad. <g>

If that's the problem it is useful to point out that that behavior is _one_
of the main reasons why services should NOT interact with the desktop and
that boilerplate code originally developed for desktop applications is NEVER
(OK rarely if one is less headstrong than I <g>) a good idea in a service.

If that's not the problem then please excuse the rant. :-)

> The service is running under "Local System" account and "Allow service
> to interact with desktop" is NOT checked.

Not only does the interactive option allow just any old user to stop a
service, it opens up a system to the "Shatter" attack. You can google for
the details.

To sum up, even though it is more work, services you develop should NOT be
interactive. Any UI chores should be handled by an ordinary Windows client
application - perhaps autostarted at login - which uses some inter-process
communication mechanism to get the service to do its bidding. If you do
that, the service behaves predictably, only ever doing what your client is
programmed to ask it to do.

> Has anyone encountered similar problem?

Not I. But I wouldn't consider either using MFC in a service or allowing it
do interact with the desktop.

Regards,
Will
Anonymous
February 2, 2005 2:10:36 AM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

Thanks for your reply..

My NT service does not create any window and does not interact with
user.

Also, as mentioned in my original post, the "Interactive" option is not
checked.
> The service is running under "Local System" account and "A­llow
service
> to interact with desktop" is NOT checked.

My NT service logs its process to the NT event "Application" log.
Interesting thing about this problem is that when "Quit" event is fired
either by "turning off the machine" or "manual stop of the service from
control panel / services", the NT service logs the "Quit", but when
user loggs off, the NT service just dies without any trace.

Is the NT service supposed to listen to "log off" event and do
something to survice the log off?
Related resources
Anonymous
February 2, 2005 11:58:37 AM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

"William DePalo [MVP VC++]" <willd.no.spam@mvps.org> wrote in message
news:eiWXQWJCFHA.3616@TK2MSFTNGP11.phx.gbl...
> "mustang" <kakyung@hotmail.com> wrote in message
> news:5f390e01.0502011115.51bfe213@posting.google.com...

....snip...

>> Has anyone encountered similar problem?
>
> Not I. But I wouldn't consider either using MFC in a service or allowing
> it do interact with the desktop.

Since services generally have no GUI it doesn't make much sense to use MFC
to create them. MFC is a GUI framework and I, like yourself, would guess
that's where the problem lies.

However, and more importently, Microsoft does not support the use of MFC in
services. If that isn't a clue as to why it should not be used, I don't know
what is!!!

HTH, Loz.
Anonymous
February 2, 2005 1:23:50 PM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

<kakyung@hotmail.com> wrote in message
news:1107328236.887978.264130@c13g2000cwb.googlegroups.com...
> Thanks for your reply..

You're welcome.

> My NT service does not create any window and does
> not interact with user.

That's good.

> Interesting thing about this problem is that when "Quit"
> event is fired either by "turning off the machine" or "manual
> stop of the service from control panel / services", the NT
> service logs the "Quit",

What is this "Quit" event? Is the service responding to the
SERVICE_CONTROL_SHUTDOWN notification from the Service Control Manager?

> Is the NT service supposed to listen to "log off" event and do
> something to survice the log off?

Nope. Services usually provide support for the _machine_ rather than a
particular user so they tend to launch in advance of any login and survive
logoff.

So, I think there are a couple of likely possibilities. Because of the
silent nature of the exit I think it is either standard operating procedure
or an anomaly. That is, I think that a window is casually responding to a
logoff or it's a serious exception. That's my hunch. So ...

If, as you say, you don't create any windows then the question is does
anything else create a Window on your behalf? I believe that at least one of
COM's apartment models creates a hidden window. So are you are using COM in
your service? Could it be that one of the windows it creates is responding
to WM_QUERYENDSESSION or WM_ENDSESSION and nonchalantly exiting?

Or is it possible that some critical resource your service need is no longer
present after the logoff and when gone somehow triggers an exception which
you don't handle.

Finally, and this is a longshot, note applications that exhaust the stack by
means of infinite recursion often die silent deaths as there is no stack
space for the reporting nechanism. Any possibility of that here?

Regards,
Will
Anonymous
February 2, 2005 1:34:49 PM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

"Lawrence Groves" <lgroves@ducost.deleteme.com> wrote in message
news:%234gNfYQCFHA.2960@TK2MSFTNGP14.phx.gbl...
> However, and more importently, Microsoft does not support the use of MFC
> in services. If that isn't a clue as to why it should not be used, I don't
> know what is!!!

And they don't support VB in services either (see
http://support.microsoft.com/kb/q175948/ ) but people do it.

In fact we had an exchange here some time ago where "help" was offered from
inside the big house on how to do that. :-)

Regards,
Will
Anonymous
February 2, 2005 6:00:53 PM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

> I have written a NT service that uses Winsock.
> This works fine until I logoff. When logoff happenes, the service just
> dies without much clue. System event log shows that "the service
> terminated unexpectedly..."
>

You can use tracing (to a file) to determine why the service stops, and how.

Also, it is possible that the service simply crashes (e.g. because of an unhandled
exception). Since JIT debugging at logoff is difficult, you can try to write a minidump
(and debug it) to see if there is an unhandled exception and why it happens.

Here is an introduction, with sample code:
http://www.codeproject.com/debug/postmortemdebug_standa...

If you search for "MiniDumpWriteDump", you can find more samples.

Regards,
Oleg
Anonymous
February 3, 2005 4:50:18 AM

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

Thanks all for your advice...

One thing I did not mention: my NT service uses a third party library.
Is it possible that this library is causing the problem? I mean this
library may call ExitProcess in response to logoff?
!