Winlogon：注销期间资源管理器终止后如何运行应用程序？
Windows XP/VISTA/7
explorer.exe 终止后，如何在用户注销过程中运行应用程序？
目的是阻止关闭，但使用在资源管理器终止后运行的应用程序。
当然可以在 Vista 中使用 ShutdownBlockReasonCreate 暂时阻止关闭，或者在 XP 中通过 WM_QUERYENDSESSION 取消关闭。但是，这两种方法都会在资源管理器终止之前的用户会话期间发生。问题是如何让应用程序在资源管理器终止后运行并阻止关闭。
这在服务中是不可能的，因为在 VISTA/7 中，如果用户选择了“关闭/重新启动”，则该服务似乎无法在用户注销后阻止关闭。 （内核似乎终止了服务，而服务本身无法像用户应用程序那样阻止关闭？）
WinLogon 到底如何以及何时终止 explorer.exe？似乎它会等到所有/任何其他应用程序终止并停止阻止关闭，然后终止资源管理器？
WinLogon 是否会等待 explorer.exe 关闭才能最终关闭桌面/会话？
我考虑过，例如尝试为终止进程的 API 挂钩 NTDLL 并拦截资源管理器的终止，但不清楚 Winlogon 如何或为何会等待而不是继续关闭。
所有这一切的目的是找到一种在 Vista/7 关闭期间运行可执行文件的方法，该方法能够根据需要阻止关闭，只有在资源管理器退出并且所有文件和资源都已由资源管理器和所有资源释放之后以该用户身份运行的其他应用程序。
在 XP 中，只需取消 WM_QUERYENDSESSION 中的关闭，然后重新发出 ExitWindowsEx (LOGOFF)，然后在系统服务中执行任务即可实现此目的。然而，它会让用户停留在登录屏幕上，没有进度指示。
如果可以在资源管理器终止后注入进程，则该进程将能够（在我的理论中）在同一用户的桌面上显示 UI，并在注销过程中有效地充当第二次自定义 shell。
人们相信/怀疑Windows在关机期间安装更新时会执行类似的操作（但迄今为止在Vista上尚未注意到这种行为）
总之，Vista中似乎没有明显的方法可以在用户注销期间关闭资源管理器后阻止关机？
Windows XP/VISTA/7
How might it be possible to run an application during the logoff procedure of a user, after explorer.exe terminates?
The purpose is to block shutdown but with an application that runs after explorer has terminated.
It is of course possible to temporararily block shutdown in vista with ShutdownBlockReasonCreate, or to cancel it in XP via WM_QUERYENDSESSION. However both of those methods occur during the user session before Explorer terminates. The question is how to get an app to run after explorer terminates AND to block shutdown.
This is not possible from a service because in VISTA/7 if the user has selected Shutdown/Restart, the service seems to have no way to block shutdown after the user has been logged-off. (The kernel seems to terminate the service and the service itself cannot block shutdown like a user app can ?)
How and when exactly does WinLogon terminate explorer.exe? It seems that it waits until all/any other applications have terminated and have ceased blocking shutdown, then it terminates explorer?
Does WinLogon wait for explorer.exe to close before it will finally close the desktop / session?
I have considered, for example attempting to hook NTDLL for the APIs that terminate a process and intercept the termination of explorer but it is unclear how or why Winlogon would then wait rather than continue the shutdown.
The purpose of all this is to find a way to run an executable during Vista/7 shutdown, which is able to block shutdown for as long as it pleases, only AFTER explorer has exited and all files and resources have been released by explorer and all other apps running as that user.
In XP this is possible by simply cancelling the shutdown in WM_QUERYENDSESSION then re-issuing ExitWindowsEx (LOGOFF) then doing the tasks in a system service. It however leaves the user at a logon screen with no progress indication.
If it was possible to inject a process after explorer terminated, the process would be able (in my theory) to show UI on the same user's desktop and effectively act as a second-time-around custom shell during the logoff procedure.
It is believed/suspected that Windows performs something similar when it installs updates during shutdown (but this behaviour has not been noted on Vista so far)
In summary there seems to be no obvious way in Vista to block shutdown after explorer closes during a user's logout?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论