App's SetProcessShutdownParameters and shuting down the system

[Viviana Vc]

Hi all,

I have 2 applications: one, let's call it the babysitter and the second
one my-app. The babysitter starts when the system starts and it is its
job to start my-app, and in case this one crashes or so to restart it.
Basically it babysitts my-app. Both are running in the background,
without any user interaction.

Because they have to always run, I wanted to make sure they don't end up
dead in case a user is doing for instance:
- chose shut-down system
- half of the applications are going down
- then there is let's say an opened notepad which was not saved
- user is asked what to do
- he canceles the shut-down
in this moment, all the app that were already killed will remain killed,
even though the system is still running.
In order to avoid this problem, I used the SetProcessShutdownParameters
(the same dwLevel=0x100 for both my applications) to let these 2
applications to get last the shut-down messages. So, when they get the
WM_ENDSESSION/WM_QUERYENDSESSION, the chances are that the system
shut-down can't be canceled anymore.

I read somewhere (and my tests proved) that the applications with the
same level of shutting down will get the shut-down messages in the order
they were started.

This works just fine on Win2k and XP:
- babysitter starts first
- my-app is started afterwards by the babysitter
- when system goes down, as babysitter was the first one started the
babysitter dies before my-app
- afterwards dies my-app

This DOESN'T work on Vista:
- babysitter starts first
- my-app is started afterwards by the babysitter
- when system goes down, for some reason my-app dies first, so the
babysitter before getting the shut-down message, tries to restart my-app
which ends up with Vista showing an ugly popup ("my-app can't be
initialized bla-bla"). I can see in the logs that my-app gets the
WM_ENDSESSION/WM_QUERYENDSESSION 4 secs before the babysitter gets them.

Question:
Why is the shut-down message received first by my-app and later by the
babysitter and not vice-versa as it was on WinXP? What else has changed
in the shut-down procedure in Vista?

Thank you in advance,
Viv

[Ibrahim Akgul]

If your is logged on and a process initiates a shutdown by calling the Windows ExitWindowsEx function, a message is sent to that session's Csrss instructing it to perfom the shutdown. Csrss in turn impersonates the caller and sends an RPC message to winlogon, telling it to perform a system shutdown. Winlogon then impersonates the currently logged-on user and calls ExitWindowsEx.

Csrss.exe sees that the request is from Winlogon and loops through all the process in the logon session of the interactive user in reverse order of their shutdown level. A process can specify a shutdown level, which indicates to the system when they want to exit with respect to other processes, by calling SetProcessShutdownParameteres. Valid shutdown levels are in the range 0 through 1023, and the default level is 640. Explorer, for example, sets its shutdown level to 2 and task manager specifies 1.For each process that owns a top-level windows, Csrss sends the WM_QUERYENDSESSION message to each thread in the process that has a windows message loop.

If the returns TRUE, the system shutdown can proceed. Csrss waits the number of seconds defined in HKCU\Control Panel\Desktop\HungAppTimeout for thread to exit (default 5000 milliseconds). If the thread doesn't exit before the timeout, Csrss fades out screen and display hung-program screen.If you want to disable this screen by changing the registry value HKCU\Control Panel\Desktop\AutoEndTasks to 1.

If the thread does exit before the timeout, Csrss continues sending the WM_QUERYENDSESSION/WM_ENDSESSION message pairs to the other threads in the process that own windows. Once all the threads that own windows in the process have exited, Csrss terminates the process and goes on to the next process in the interactive session.

[Ibrahim Akgul]

If your is logged on and a process initiates a shutdown by calling the Windows ExitWindowsEx function, a message is sent to that session's Csrss instructing it to perfom the shutdown. Csrss in turn impersonates the caller and sends an RPC message to winlogon, telling it to perform a system shutdown. Winlogon then impersonates the currently logged-on user and calls ExitWindowsEx.

Csrss.exe sees that the request is from Winlogon and loops through all the process in the logon session of the interactive user in reverse order of their shutdown level. A process can specify a shutdown level, which indicates to the system when they want to exit with respect to other processes, by calling SetProcessShutdownParameteres. Valid shutdown levels are in the range 0 through 1023, and the default level is 640. Explorer, for example, sets its shutdown level to 2 and task manager specifies 1.For each process that owns a top-level windows, Csrss sends the WM_QUERYENDSESSION message to each thread in the process that has a windows message loop.

If the returns TRUE, the system shutdown can proceed. Csrss waits the number of seconds defined in HKCU\Control Panel\Desktop\HungAppTimeout for thread to exit (default 5000 milliseconds). If the thread doesn't exit before the timeout, Csrss fades out screen and display hung-program screen.If you want to disable this screen by changing the registry value HKCU\Control Panel\Desktop\AutoEndTasks to 1.

If the thread does exit before the timeout, Csrss continues sending the WM_QUERYENDSESSION/WM_ENDSESSION message pairs to the other threads in the process that own windows. Once all the threads that own windows in the process have exited, Csrss terminates the process and goes on to the next process in the interactive session.

> On Thursday, July 26, 2007 10:06 AM Viviana Vc wrote: