NT service: terminated after user logoff

Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

Hello, all.

I have written a NT service that uses Winsock.
This works fine until I logoff. When logoff happenes, the service just
dies without much clue. System event log shows that "the service
terminated unexpectedly..."

The service is running under "Local System" account and "Allow service
to interact with desktop" is NOT checked.

Has anyone encountered similar problem?
Your knowledge sharing is really appreciated.

Thanks in advance.

Kaky
7 answers Last reply
More about service terminated user logoff
  1. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    "mustang" <kakyung@hotmail.com> wrote in message
    news:5f390e01.0502011115.51bfe213@posting.google.com...
    > I have written a NT service that uses Winsock.

    OK.

    > This works fine until I logoff. When logoff happenes, the service just
    > dies without much clue. System event log shows that "the service
    > terminated unexpectedly..."

    This is an educated guess:

    Does you service create any windows? Are they visible when the user logs
    off? If you are using boilerplate code (MFC, etc) for the shell of your
    service then it may be that that when your window is closed at loggof, the
    boilerplate's WM_CLOSE message handler (or perhaps the WM_ENDSESSION
    handler) does a DestroyWindow() on your main window which causes a
    WM_DESTROY message whose handler does a PostQuitMessage(0) which terminates
    the application. That would be bad. <g>

    If that's the problem it is useful to point out that that behavior is _one_
    of the main reasons why services should NOT interact with the desktop and
    that boilerplate code originally developed for desktop applications is NEVER
    (OK rarely if one is less headstrong than I <g>) a good idea in a service.

    If that's not the problem then please excuse the rant. :-)

    > The service is running under "Local System" account and "Allow service
    > to interact with desktop" is NOT checked.

    Not only does the interactive option allow just any old user to stop a
    service, it opens up a system to the "Shatter" attack. You can google for
    the details.

    To sum up, even though it is more work, services you develop should NOT be
    interactive. Any UI chores should be handled by an ordinary Windows client
    application - perhaps autostarted at login - which uses some inter-process
    communication mechanism to get the service to do its bidding. If you do
    that, the service behaves predictably, only ever doing what your client is
    programmed to ask it to do.

    > Has anyone encountered similar problem?

    Not I. But I wouldn't consider either using MFC in a service or allowing it
    do interact with the desktop.

    Regards,
    Will
  2. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    Thanks for your reply..

    My NT service does not create any window and does not interact with
    user.

    Also, as mentioned in my original post, the "Interactive" option is not
    checked.
    > The service is running under "Local System" account and "A­llow
    service
    > to interact with desktop" is NOT checked.

    My NT service logs its process to the NT event "Application" log.
    Interesting thing about this problem is that when "Quit" event is fired
    either by "turning off the machine" or "manual stop of the service from
    control panel / services", the NT service logs the "Quit", but when
    user loggs off, the NT service just dies without any trace.

    Is the NT service supposed to listen to "log off" event and do
    something to survice the log off?
  3. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    "William DePalo [MVP VC++]" <willd.no.spam@mvps.org> wrote in message
    news:eiWXQWJCFHA.3616@TK2MSFTNGP11.phx.gbl...
    > "mustang" <kakyung@hotmail.com> wrote in message
    > news:5f390e01.0502011115.51bfe213@posting.google.com...

    ....snip...

    >> Has anyone encountered similar problem?
    >
    > Not I. But I wouldn't consider either using MFC in a service or allowing
    > it do interact with the desktop.

    Since services generally have no GUI it doesn't make much sense to use MFC
    to create them. MFC is a GUI framework and I, like yourself, would guess
    that's where the problem lies.

    However, and more importently, Microsoft does not support the use of MFC in
    services. If that isn't a clue as to why it should not be used, I don't know
    what is!!!

    HTH, Loz.
  4. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    <kakyung@hotmail.com> wrote in message
    news:1107328236.887978.264130@c13g2000cwb.googlegroups.com...
    > Thanks for your reply..

    You're welcome.

    > My NT service does not create any window and does
    > not interact with user.

    That's good.

    > Interesting thing about this problem is that when "Quit"
    > event is fired either by "turning off the machine" or "manual
    > stop of the service from control panel / services", the NT
    > service logs the "Quit",

    What is this "Quit" event? Is the service responding to the
    SERVICE_CONTROL_SHUTDOWN notification from the Service Control Manager?

    > Is the NT service supposed to listen to "log off" event and do
    > something to survice the log off?

    Nope. Services usually provide support for the _machine_ rather than a
    particular user so they tend to launch in advance of any login and survive
    logoff.

    So, I think there are a couple of likely possibilities. Because of the
    silent nature of the exit I think it is either standard operating procedure
    or an anomaly. That is, I think that a window is casually responding to a
    logoff or it's a serious exception. That's my hunch. So ...

    If, as you say, you don't create any windows then the question is does
    anything else create a Window on your behalf? I believe that at least one of
    COM's apartment models creates a hidden window. So are you are using COM in
    your service? Could it be that one of the windows it creates is responding
    to WM_QUERYENDSESSION or WM_ENDSESSION and nonchalantly exiting?

    Or is it possible that some critical resource your service need is no longer
    present after the logoff and when gone somehow triggers an exception which
    you don't handle.

    Finally, and this is a longshot, note applications that exhaust the stack by
    means of infinite recursion often die silent deaths as there is no stack
    space for the reporting nechanism. Any possibility of that here?

    Regards,
    Will
  5. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    "Lawrence Groves" <lgroves@ducost.deleteme.com> wrote in message
    news:%234gNfYQCFHA.2960@TK2MSFTNGP14.phx.gbl...
    > However, and more importently, Microsoft does not support the use of MFC
    > in services. If that isn't a clue as to why it should not be used, I don't
    > know what is!!!

    And they don't support VB in services either (see
    http://support.microsoft.com/kb/q175948/ ) but people do it.

    In fact we had an exchange here some time ago where "help" was offered from
    inside the big house on how to do that. :-)

    Regards,
    Will
  6. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    > I have written a NT service that uses Winsock.
    > This works fine until I logoff. When logoff happenes, the service just
    > dies without much clue. System event log shows that "the service
    > terminated unexpectedly..."
    >

    You can use tracing (to a file) to determine why the service stops, and how.

    Also, it is possible that the service simply crashes (e.g. because of an unhandled
    exception). Since JIT debugging at logoff is difficult, you can try to write a minidump
    (and debug it) to see if there is an unhandled exception and why it happens.

    Here is an introduction, with sample code:
    http://www.codeproject.com/debug/postmortemdebug_standalone1.asp

    If you search for "MiniDumpWriteDump", you can find more samples.

    Regards,
    Oleg
  7. Archived from groups: microsoft.public.vc.language,microsoft.public.windowsnt.setup (More info?)

    Thanks all for your advice...

    One thing I did not mention: my NT service uses a third party library.
    Is it possible that this library is causing the problem? I mean this
    library may call ExitProcess in response to logoff?
Ask a new question

Read More

Desktops Microsoft Winsock Windows