How to change the order of closing apps on Windows exit? RRS feed

  • Question

  • Hi,

         In which order Windows is closing apps on Windows shutdown?

    How can I influence which app Windows will try to close as the last one?



    Monday, August 5, 2013 9:17 PM

All replies

  • Hi,

    Shutdown is initiated in one of three ways: an ordinary application process calls InitiateSystemShutdownEx(), an application process calls ExitWindowsEx() with parameters requesting a system shutdown, or the interactive user in session 1 triggers the Secure Attention Sequence. Both of the former two actually end up simulating the third.

    When an ordinary application process calls ExitWindowsEx() to request a shutdown, a logoff, a power-down, a halt, or a reboot, the first behaviour of ExitWindowsEx() is invoked. ExitWindowsEx() (i.e. CSRSS acting upon the calling process' behalf) simply sends a window message to a window owned by the WINLOGON process for the current session to simulate the interactive user choosing the equivalent action from the WINLOGON user interface. So in the case of ExitWindowsEx() being called to initiate a shutdown, a window message is sent to the WINLOGON process for that session, requesting a shutdown, and WINLOGON behaves from that point just as if shutdown had been requested via its user interface.

    This is why, incidentally, ExitWindowsEx() only has an effect if the process invoking it is being run in session 1. (Microsoft says "by the interactive user", which can be misleading. This is what it actually means.) ExitWindowsEx() sends a window message to the WINLOGON process for the session in which the invoking process is running. But only the WINLOGON process in session 1 does anything in response to the message, because it is the only session talking to a "local" user; and, indeed, other sessions do not necessarily have WINLOGON processes at all. (Session 0 has WININIT, not WINLOGON.) Therefore, only when a process is runnng in session 1 does ExitWindowsEx() have any actual effect.

    The behaviour of InitiateSystemShutdownEx() is similar, albeit slightly more complicated by the fact that shutdowns triggered in this way can be deferred. When an ordinary application process calls InitiateSystemShutdownEx() it connects to the \InitShutdown named pipe and using that pipe performs an RPC to schedule a shutdown. The server for that named pipe is WINLOGON, which handles all of the details of deferring the shutdown, and actually triggering the shutdown at the scheduled time. WINLOGON also allows already scheduled deferred shutdown requests to be cancelled. AbortSystemShutdown() performs an RPC via the same named pipe to request that a previously scheduled shutdown be cancelled.

    The function in WINLOGON that handles the "initiate shutdown" request via the named pipe is BaseInitiateShutdownEx(). This checks the client's privilege level, checks the validity of the request, checks to ensure that a shutdown is not already scheduled and that a shutdown has not already begun, checks to see whether WINLOGON is not in the "logged-on and locked" state, writes a record to the audit log, and (if everything succeeds to this point — flags in the request allowing some of the aforementioned checks to be overridden) starts a thread to actually perform the shutdown at the scheduled time.

    The thread runs the not-quite-appropriately-named LogoffThreadProc() function. This function waits until the specified time, displaying a "countdown" dialogue box in the interim, and then calls ExitWindowsEx(). This is a normal call to ExitWindowsEx(), which sends a message to WINLOGON to simulate shutdown being requested via its user interface.

    WINLOGON has various internal flags and variables that control this deferred shutdown mechanism. The ShutdownInProgress flag records the fact that a shutdown is already scheduled (i.e. the thread has already been invoked). The ShutdownTime variable records the time that the thread will wait until before actually initiating the shutdown. The ShutdownHasBegun records the fact that a shutdown has begun (i.e. the thread has called ExitWindowsEx()). The AbortShutdown flag is set if an "abort shutdown" request comes in via the named pipe or if abort is chosen from the "countdown" dialogue box.

    You can refer to the link below for more details about Windows NT shutdown process.


    Wednesday, August 7, 2013 7:57 AM
  • Unforunately I cannot find the answer to my question in your post.
    My question is:

    How to tell Windows which application to close as the last one on the Windows shutdown.

     I do not care what are the ways of terminating Windows.

    I observe that Windows on shutdown displays the list of running applications and it closes them one by one in sequential order. I would like to influence that list that way, that one specially choosen by me application will always appear as the last one on that list.



    • Edited by jastrzebiec Monday, August 12, 2013 2:30 PM
    Monday, August 12, 2013 2:29 PM
  • Hi,

    Windows just starts sending every app a WM_QUERYENDSESSION message then, assuming nothing attempts to block shutdown, sends everything an WM_ENDSESSION message. Apps have to respond in a timely fashion to these messages or Windows will just kill them The end result of this is that there is no defined order of apps shutting down and you should never ever try to rely on one.

    In addition, you also can refer to the link below for more details about System Shutdown Messages.

    Tuesday, August 20, 2013 9:58 AM