Link to home
Start Free TrialLog in
Avatar of dspent
dspentFlag for United States of America

asked on

Windows Logoff Process

When I click the logoff button in Windows 2000 or XP or 2003 does anyone know what process/executable/registry key/API or function gets called so that Windows performs the log off?


Here's my problem....  We have a desktop management app that is continuously running a process called SLAGENT.EXE on the client machine.  When the user clicks the logoff button, SLAGENT somehow is able to intercept the logoff process, run various logoff scripts, then return control back to windows to finish logging off.  We have just implemented a Single Sign-On application in our facility that has its own logoff button on a launchpad.  If a user clicks that button they execute SHUTDOWN.EXE -L which comes from the windows 2000/2003 resource kit.   The problem with that is that my logoff scripting is somehow bypassed.  Apparently SLAGENT doesn't "see" that windows is logging off and never intercepts the process to do its thing. What I need to know is what process gets called by clicking the windows logoff button?

I have been searching for this for days and apparently this is the best kept secret in the world.  I'm so frustrated.  I feel like I would be easier to break into fort knox than find out this stupid process.  PLEASE PLEASE PLEASE anyone who can, I would appreciate your assistance.
ASKER CERTIFIED SOLUTION
Avatar of jkr
jkr
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
logoff.exe

If you put that into command prompt....you get logged off immediatley.
Avatar of dspent

ASKER

jkr -
How would I write a script (batch or vbs etc...) to call that function?
For that purpse, you can just

Rundll32.exe User.exe,ExitWindows
Avatar of dspent

ASKER

nope.... doesn't work in win XP SP2....
I also tried Rundll32.exe User32.DLL,ExitWindows

I get an error that says missing ExitWindows
Hm, you could also just use

rem batch to shutdown computer
shutdown.exe

Try 'shutdown.exe /?' for more options.
Avatar of dspent

ASKER

apparently you did not read the question.  I am using shutdown.exe -L which logs the user off but bypasses the logoff script because that script does not recognize that windows is logging off when using shutdown.exe
I read it, but that was a  bunch of days ago. Any other chances for you to call that API?
dude....

When you click logoff on the start menu....   then you click the logoff button....the program that windows executes is called "LOGOFF.EXE"  If you launch that..you will be logged out without confirmation.

If you put logoff.exe in a batch script....you will be logged out as well.

c:\WINDOWS\system32\logoff.exe

Avatar of dspent

ASKER

Let me post this again so you all can see what I am asking:

"We have just implemented a Single Sign-On application in our facility that has its own logoff button on a launchpad.  If a user clicks that button they execute SHUTDOWN.EXE -L which comes from the windows 2000/2003 resource kit.   The problem with that is that my logoff scripting is somehow bypassed.  Apparently SLAGENT doesn't "see" that windows is logging off and never intercepts the process to do its thing."

Shutdown.exe AND Logoff.exe when executed directly OR from a script do not allow any logoff scripting or other processes to occur.
Avatar of dspent

ASKER

Although the function suggested is the correct function... The question was how to make slagent.exe "see" that the function was called and be able to intercept the logoff process and perform its actions before retirning control to the windows logoff process.  So while the answer here was correct it in no way solved the problem.