UnloadMode in QueryUnload Event

[Daryl M]

I have a simple application (consisting of a single form) that is basically
a background task with processing being triggered by the presence of a file.
What I want to do is prevent the app from being shut down by the user
through the Task Manager if the app is in the middle of a process.

Looking at the help for the QueryUnload event, it says that the UnloadMode
will be set to a 3 if the Microsoft Task Manager is closing the application.
When I close my app with the Task Manager, it does not go through the form's
QueryUnload event at all.

Am I doing something wrong, or is this dependant on the operating system? I
have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA

[Dave Britton]

If you end the Application it will fire the query unload, if you end the Process
it will not. Let me think of how to trap that ....



"Daryl M" <darylm4290@aol.com> wrote:
>I have a simple application (consisting of a single form) that is basically
>a background task with processing being triggered by the presence of a file.
>What I want to do is prevent the app from being shut down by the user
>through the Task Manager if the app is in the middle of a process.
>
>Looking at the help for the QueryUnload event, it says that the UnloadMode
>will be set to a 3 if the Microsoft Task Manager is closing the application.
>When I close my app with the Task Manager, it does not go through the form's
>QueryUnload event at all.
>
>Am I doing something wrong, or is this dependant on the operating system?
I
>have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
>
>

[Karl E. Peterson]

Hi Daryl --

> I have a simple application (consisting of a single form) that is basically
> a background task with processing being triggered by the presence of a file.
> What I want to do is prevent the app from being shut down by the user
> through the Task Manager if the app is in the middle of a process.
>
> Looking at the help for the QueryUnload event, it says that the UnloadMode
> will be set to a 3 if the Microsoft Task Manager is closing the application.
> When I close my app with the Task Manager, it does not go through the form's
> QueryUnload event at all.
>
> Am I doing something wrong, or is this dependant on the operating system? I
> have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA

I just tried in Win2000, and it worked just fine. Here's the complete code:

Option Explicit

Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
End Sub

Thinking something amiss, I also tried running it from an NT4 server, and an NT4
workstation. In all cases, selecting "End Task" produced the desired results.

When I went to the Processes tab, and selected "End Process", it did what you
describe. You really can't prevent that, and that's why TaskMan throws up a warning
and asks you if you're sure that's what you want to do. This is the difference
between WM_CLOSE and TerminateProcess. If you're unsure I may be right, see the MSDN
docs on the latter API call.

Later... Karl
--
http://www.mvps.org/vb

[mrfelis]

THis works on Win 98 as well.

--
~~~
!ti timda I ,KO
..em deppals nocaeB sivaM
!draH
~~
C'Ya,
mrfelis@yahoo!com
Karl E. Peterson <karl@mvps.org> wrote in message
news:3a381935$1@news.devx.com...
> Hi Daryl --
>
> > I have a simple application (consisting of a single form) that is
basically
> > a background task with processing being triggered by the presence of a
file.
> > What I want to do is prevent the app from being shut down by the user
> > through the Task Manager if the app is in the middle of a process.
> >
> > Looking at the help for the QueryUnload event, it says that the
UnloadMode
> > will be set to a 3 if the Microsoft Task Manager is closing the
application.
> > When I close my app with the Task Manager, it does not go through the
form's
> > QueryUnload event at all.
> >
> > Am I doing something wrong, or is this dependant on the operating
system? I
> > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
>
> I just tried in Win2000, and it worked just fine. Here's the complete
code:
>
> Option Explicit
>
> Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
> MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
> End Sub
>
> Thinking something amiss, I also tried running it from an NT4 server, and
an NT4
> workstation. In all cases, selecting "End Task" produced the desired
results.
>
> When I went to the Processes tab, and selected "End Process", it did what
you
> describe. You really can't prevent that, and that's why TaskMan throws up
a warning
> and asks you if you're sure that's what you want to do. This is the
difference
> between WM_CLOSE and TerminateProcess. If you're unsure I may be right,
see the MSDN
> docs on the latter API call.
>
> Later... Karl
> --
> http://www.mvps.org/vb
>
>

[Daryl M]

Karl,

Thanks for the response. You are correct about End Task firing the
QueryUnload event. I also had a messagebox in the QueryUnload event, and the
reason I didn't think the QueryUnload event was fired was that when the Task
Manager window was displayed and I selected End Task, then the msgbox from
the QueryUnload event was displayed, but it was behind the Task Manager
window (it does not come to the foreground). And since I didn't respond to
the msgbox, the Task Manager thinks the program is not responding, so it
throws up another message asking whether to Wait, End Task or Cancel. Of
course when I select End Task again the program terminates (which appears to
use the same method as End Process).

I tried setting Cancel = True if UnloadMode = 3 (which should in effect
prevent the user from using End Task), but the Task Manager will still put
up the second dialog asking whether to Wait, End Task or Cancel. So even
though I can detect if the app is being closed with Task Manager (with End
Task), the second dialog box appears and uses the End Process if the user
selects End Task, which of course defeats the whole process of trying to
prevent the shut down of the app. Any ideas on how to prevent this?




"Karl E. Peterson" <karl@mvps.org> wrote in message
news:3a381935$1@news.devx.com...
> Hi Daryl --
>
> > I have a simple application (consisting of a single form) that is
basically
> > a background task with processing being triggered by the presence of a
file.
> > What I want to do is prevent the app from being shut down by the user
> > through the Task Manager if the app is in the middle of a process.
> >
> > Looking at the help for the QueryUnload event, it says that the
UnloadMode
> > will be set to a 3 if the Microsoft Task Manager is closing the
application.
> > When I close my app with the Task Manager, it does not go through the
form's
> > QueryUnload event at all.
> >
> > Am I doing something wrong, or is this dependant on the operating
system? I
> > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
>
> I just tried in Win2000, and it worked just fine. Here's the complete
code:
>
> Option Explicit
>
> Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
> MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
> End Sub
>
> Thinking something amiss, I also tried running it from an NT4 server, and
an NT4
> workstation. In all cases, selecting "End Task" produced the desired
results.
>
> When I went to the Processes tab, and selected "End Process", it did what
you
> describe. You really can't prevent that, and that's why TaskMan throws up
a warning
> and asks you if you're sure that's what you want to do. This is the
difference
> between WM_CLOSE and TerminateProcess. If you're unsure I may be right,
see the MSDN
> docs on the latter API call.
>
> Later... Karl
> --
> http://www.mvps.org/vb
>
>

[Karl E. Peterson]

Hi Daryl --

Yeah, I can see how that would be. TaskMan starts out polite, and becomes
increasingly rude with non-responsive apps. It definitely considers msgbox's to be
impediments to progress. So, a WM_CLOSE is sent with SendMessageTimeout, and that
failing, it asks whether to throw a TerminateProcess at it. Afaik, there is no way
to prevent this call from success, short of preventing a process from obtaining
PROCESS_TERMINATE rights. TaskMan operates in a rather priviledged environment, and
generally succeeds at obtaining these rights, when it asks. There _may_ be some
potential way of averting this by fiddling with SetSecurityInfo, but that just looks
mondo-nasty on the face of it. At any rate, that'd be the avenue to pursue.

Good luck... Karl
--
http://www.mvps.org/vb


"Daryl M" <darylm4290@aol.com> wrote in message news:3a38e5c4@news.devx.com...
> Karl,
>
> Thanks for the response. You are correct about End Task firing the
> QueryUnload event. I also had a messagebox in the QueryUnload event, and the
> reason I didn't think the QueryUnload event was fired was that when the Task
> Manager window was displayed and I selected End Task, then the msgbox from
> the QueryUnload event was displayed, but it was behind the Task Manager
> window (it does not come to the foreground). And since I didn't respond to
> the msgbox, the Task Manager thinks the program is not responding, so it
> throws up another message asking whether to Wait, End Task or Cancel. Of
> course when I select End Task again the program terminates (which appears to
> use the same method as End Process).
>
> I tried setting Cancel = True if UnloadMode = 3 (which should in effect
> prevent the user from using End Task), but the Task Manager will still put
> up the second dialog asking whether to Wait, End Task or Cancel. So even
> though I can detect if the app is being closed with Task Manager (with End
> Task), the second dialog box appears and uses the End Process if the user
> selects End Task, which of course defeats the whole process of trying to
> prevent the shut down of the app. Any ideas on how to prevent this?
>
>
>
>
> "Karl E. Peterson" <karl@mvps.org> wrote in message
> news:3a381935$1@news.devx.com...
> > Hi Daryl --
> >
> > > I have a simple application (consisting of a single form) that is
> basically
> > > a background task with processing being triggered by the presence of a
> file.
> > > What I want to do is prevent the app from being shut down by the user
> > > through the Task Manager if the app is in the middle of a process.
> > >
> > > Looking at the help for the QueryUnload event, it says that the
> UnloadMode
> > > will be set to a 3 if the Microsoft Task Manager is closing the
> application.
> > > When I close my app with the Task Manager, it does not go through the
> form's
> > > QueryUnload event at all.
> > >
> > > Am I doing something wrong, or is this dependant on the operating
> system? I
> > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
> >
> > I just tried in Win2000, and it worked just fine. Here's the complete
> code:
> >
> > Option Explicit
> >
> > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
> > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
> > End Sub
> >
> > Thinking something amiss, I also tried running it from an NT4 server, and
> an NT4
> > workstation. In all cases, selecting "End Task" produced the desired
> results.
> >
> > When I went to the Processes tab, and selected "End Process", it did what
> you
> > describe. You really can't prevent that, and that's why TaskMan throws up
> a warning
> > and asks you if you're sure that's what you want to do. This is the
> difference
> > between WM_CLOSE and TerminateProcess. If you're unsure I may be right,
> see the MSDN
> > docs on the latter API call.
> >
> > Later... Karl
> > --
> > http://www.mvps.org/vb
> >
> >
>
>

[Daryl M]

Thanks again for the info. I think this is just going to have to be a
training issue and be treated the same as if the power to the machine is
turned off.


"Karl E. Peterson" <karl@mvps.org> wrote in message
news:3a3903d6$1@news.devx.com...
> Hi Daryl --
>
> Yeah, I can see how that would be. TaskMan starts out polite, and becomes
> increasingly rude with non-responsive apps. It definitely considers
msgbox's to be
> impediments to progress. So, a WM_CLOSE is sent with SendMessageTimeout,
and that
> failing, it asks whether to throw a TerminateProcess at it. Afaik, there
is no way
> to prevent this call from success, short of preventing a process from
obtaining
> PROCESS_TERMINATE rights. TaskMan operates in a rather priviledged
environment, and
> generally succeeds at obtaining these rights, when it asks. There _may_
be some
> potential way of averting this by fiddling with SetSecurityInfo, but that
just looks
> mondo-nasty on the face of it. At any rate, that'd be the avenue to
pursue.
>
> Good luck... Karl
> --
> http://www.mvps.org/vb
>
>
> "Daryl M" <darylm4290@aol.com> wrote in message
news:3a38e5c4@news.devx.com...
> > Karl,
> >
> > Thanks for the response. You are correct about End Task firing the
> > QueryUnload event. I also had a messagebox in the QueryUnload event, and
the
> > reason I didn't think the QueryUnload event was fired was that when the
Task
> > Manager window was displayed and I selected End Task, then the msgbox
from
> > the QueryUnload event was displayed, but it was behind the Task Manager
> > window (it does not come to the foreground). And since I didn't respond
to
> > the msgbox, the Task Manager thinks the program is not responding, so it
> > throws up another message asking whether to Wait, End Task or Cancel. Of
> > course when I select End Task again the program terminates (which
appears to
> > use the same method as End Process).
> >
> > I tried setting Cancel = True if UnloadMode = 3 (which should in effect
> > prevent the user from using End Task), but the Task Manager will still
put
> > up the second dialog asking whether to Wait, End Task or Cancel. So even
> > though I can detect if the app is being closed with Task Manager (with
End
> > Task), the second dialog box appears and uses the End Process if the
user
> > selects End Task, which of course defeats the whole process of trying to
> > prevent the shut down of the app. Any ideas on how to prevent this?
> >
> >
> >
> >
> > "Karl E. Peterson" <karl@mvps.org> wrote in message
> > news:3a381935$1@news.devx.com...
> > > Hi Daryl --
> > >
> > > > I have a simple application (consisting of a single form) that is
> > basically
> > > > a background task with processing being triggered by the presence of
a
> > file.
> > > > What I want to do is prevent the app from being shut down by the
user
> > > > through the Task Manager if the app is in the middle of a process.
> > > >
> > > > Looking at the help for the QueryUnload event, it says that the
> > UnloadMode
> > > > will be set to a 3 if the Microsoft Task Manager is closing the
> > application.
> > > > When I close my app with the Task Manager, it does not go through
the
> > form's
> > > > QueryUnload event at all.
> > > >
> > > > Am I doing something wrong, or is this dependant on the operating
> > system? I
> > > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
> > >
> > > I just tried in Win2000, and it worked just fine. Here's the complete
> > code:
> > >
> > > Option Explicit
> > >
> > > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As
Integer)
> > > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
> > > End Sub
> > >
> > > Thinking something amiss, I also tried running it from an NT4 server,
and
> > an NT4
> > > workstation. In all cases, selecting "End Task" produced the desired
> > results.
> > >
> > > When I went to the Processes tab, and selected "End Process", it did
what
> > you
> > > describe. You really can't prevent that, and that's why TaskMan
throws up
> > a warning
> > > and asks you if you're sure that's what you want to do. This is the
> > difference
> > > between WM_CLOSE and TerminateProcess. If you're unsure I may be
right,
> > see the MSDN
> > > docs on the latter API call.
> > >
> > > Later... Karl
> > > --
> > > http://www.mvps.org/vb
> > >
> > >
> >
> >
>

[Karl E. Peterson]

Hi Daryl --

> Thanks again for the info. I think this is just going to have to be a
> training issue and be treated the same as if the power to the machine is
> turned off.

I think that's a really good way to look at it. I asked a fellow who I consider to
be *tops* in the field and this was his response:

>you'd have to change the DACL -- but that still leaves a hole: a
>determined killer who was launched by the same user might use its owner
>privilege to rewrite the DACL, giving himself terminate permission, and
>then reopen the target process. Finally, admin and SYSTEM can take
>ownership and then rewrite the DACL.
>
>However, for most purposes, just fixing a DACL that grants nobody
>PROCESS_TERMINATE access should do it.

Followed by:

>yes, taskmgr.exe runs as system, and no, it does not do any fancy
>footwork. Just remember, though, that a process which has activated
>SeDebugPrivilege can open _any_ other process with _any_ desired
>permission -- no defense against that.

Looking up SeDebugPrivilege in MSDN confirms there's no getting around these issues.
See:

HOWTO: Use the SeDebugPrivilege to Acquire Any Process Handle, ID: Q185215
http://support.microsoft.com/support.../q185/2/15.asp

for the cold reality.

Later... Karl
--
http://www.mvps.org/vb