? User logoff

> Out of the box, you can't. The best you can have is "logon session

> termination", but it will happen any time after the logoff. If you don't

"Logon session termination" is logoff, at least in terms of security log.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:e7fl8NGoDHA.1096@TK2MSFTNGP11.phx.gbl...

> > Out of the box, you can't. The best you can have is "logon session
> > termination", but it will happen any time after the logoff. If you don't

>
> "Logon session termination" is logoff, at least in terms of security log.

Except that it may happen hours after the "logoff" in terms of Winlogon and
the human user. And sometimes you can have two logon sessions for a single
logon, one of which will terminate in milliseconds. The latter happens
fairly frequently on XP and 2K3.

Without knowing the requirements, it is hard to suggest anything. Winlogon
notifications might be the greatest common denominator.

S

Run a service which can receive logoff notifications. Have the service send
an IOCTL to the driver.

"Aleksey Rechinsky" <ar_(dont_spam)faramir@mail.ru> wrote in message
news:emSHDZunDHA.1764@tk2msftngp13.phx.gbl...

> Hello!
>
> I should do some work at user logoff in my driver, but can't find any info
> in DDK about logoff event. Does anybody knows how to receive "user logoff"
> notification in kernel mode?
>
> OS - Windows 2000 and later.
>
> Thanks for any info.
>
> Aleksey.
>
>

This is especially easy on XP/2K3, where your service can receive a
SERVICE_CONTROL_SESSIONCHANGE notification; very useful for handling Fast
User Switching on XP.

"Alexander Grigoriev" <alegr@earthlink.net> wrote in message
news:%23Z4nHfvnDHA.2772@TK2MSFTNGP10.phx.gbl...

> Run a service which can receive logoff notifications. Have the service

send

> an IOCTL to the driver.
>
> "Aleksey Rechinsky" <ar_(dont_spam)faramir@mail.ru> wrote in message
> news:emSHDZunDHA.1764@tk2msftngp13.phx.gbl...

> > Hello!
> >
> > I should do some work at user logoff in my driver, but can't find any

info

> > in DDK about logoff event. Does anybody knows how to receive "user

logoff"

> > notification in kernel mode?
> >
> > OS - Windows 2000 and later.
> >
> > Thanks for any info.
> >
> > Aleksey.
> >
> >

>
>

Another (slightly kludgey) way this can be accomplished (depending on
exactly what you want) is to run a user-mode application from the Run
key that just sits in the background and does nothing except notice the
appropriate termination messages, upon which it sends an IOCTL to you
driver. This is especially convenient if you happen to have any settings
you want to store in HKCU, since you already have to have a resident
program sitting around IOCTLing your driver so it can access the
registry in the context of a user thread...

Aleksey Rechinsky wrote:

> Hello!
>
> I should do some work at user logoff in my driver, but can't find any info
> in DDK about logoff event. Does anybody knows how to receive "user logoff"
> notification in kernel mode?
>
> OS - Windows 2000 and later.
>
> Thanks for any info.
>
> Aleksey.
>
>

--
.../ray\..

"Ray Trent" <rat@synaptics.com.spamblock> wrote in message
news:uORqQX0nDHA.3256@tk2msftngp13.phx.gbl...

> Another (slightly kludgey) way this can be accomplished (depending on
> exactly what you want) is to run a user-mode application from the Run
> key that just sits in the background and does nothing except notice the
> appropriate termination messages, upon which it sends an IOCTL to you
> driver. This is especially convenient if you happen to have any settings
> you want to store in HKCU, since you already have to have a resident
> program sitting around IOCTLing your driver so it can access the
> registry in the context of a user thread...

Hmm not that kludgy at all. I think the best way to handle it is to perform
the cleaning inside IRP_MJ_CLEANUP. The user mode application is guaranteed
to die (of course if the driver does not block it forever) and the driver is
guaranteed to receive the IRP.

This way the application only needs to open a handle to the device.

This approach nicely scales to multi user scenario. Others here suggested NT
service - I would argue against it for this exactly reason.

-Kirk

Why not rely on SeRegisterLogonSessionForTerminationNotification and treat
logon session termination as logoff? Advantage: no additional user code.
Drawback: cannot catch Fast User Switching.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


"Ray Trent" <rat@synaptics.com.spamblock> wrote in message
news:uORqQX0nDHA.3256@tk2msftngp13.phx.gbl...

> Another (slightly kludgey) way this can be accomplished (depending on
> exactly what you want) is to run a user-mode application from the Run
> key that just sits in the background and does nothing except notice the
> appropriate termination messages, upon which it sends an IOCTL to you
> driver. This is especially convenient if you happen to have any settings
> you want to store in HKCU, since you already have to have a resident
> program sitting around IOCTLing your driver so it can access the
> registry in the context of a user thread...
>
> Aleksey Rechinsky wrote:
>

> > Hello!
> >
> > I should do some work at user logoff in my driver, but can't find any info
> > in DDK about logoff event. Does anybody knows how to receive "user logoff"
> > notification in kernel mode?
> >
> > OS - Windows 2000 and later.
> >
> > Thanks for any info.
> >
> > Aleksey.
> >
> >

>
> --
> ../ray\..
>

It all depends what's the purpose of the logoff notification, how reliable
it should be, etc. We don't know what's the OP goal.

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:ub7V$NGoDHA.1096@TK2MSFTNGP11.phx.gbl...

> Why not rely on SeRegisterLogonSessionForTerminationNotification and treat
> logon session termination as logoff? Advantage: no additional user code.
> Drawback: cannot catch Fast User Switching.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
>