Difference in logout events of Windows XP and Windows 7

Question

I have a service / application that receives notification of changes to a Windows session. I have noticed a difference in behavior between Windows XP and Windows 7 and am trying to determine if this is a bug or a documented behavior change.

Notifications are included as: WTSSESSION_NOTIFICATION .

Windows XP reports as expected: WTS_SESSION_LOGON when entering the Windows GUI and: WTS_SESSION_LOGOFF when exiting the Windows GUI.

On Windows 7 x64 in gui login, WTS_SESSION_LOGON is created, but when I WTS_CONSOLE_DISCONNECT out I get the WTS_CONSOLE_DISCONNECT event instead of the WTS_SESSION_LOGOFF event.

Is this a bug or are constant values ​​changing between versions? This is not very important for the service I developed, but I would still like to know why it behaves differently.

Answer 1

Only services can receive the WTS_SESSION_LOGOFF event in Windows 7. By the time the service receives a notification, the logout procedure has been completed (so that all applications that were started by the user are already killed).