UnloadMode in QueryUnload Event


DevX Home    Today's Headlines   Articles Archive   Tip Bank   Forums   

Results 1 to 8 of 8

Thread: UnloadMode in QueryUnload Event

  1. #1
    Daryl M Guest

    UnloadMode in QueryUnload Event

    I have a simple application (consisting of a single form) that is basically
    a background task with processing being triggered by the presence of a file.
    What I want to do is prevent the app from being shut down by the user
    through the Task Manager if the app is in the middle of a process.

    Looking at the help for the QueryUnload event, it says that the UnloadMode
    will be set to a 3 if the Microsoft Task Manager is closing the application.
    When I close my app with the Task Manager, it does not go through the form's
    QueryUnload event at all.

    Am I doing something wrong, or is this dependant on the operating system? I
    have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA



  2. #2
    Dave Britton Guest

    Re: UnloadMode in QueryUnload Event


    If you end the Application it will fire the query unload, if you end the Process
    it will not. Let me think of how to trap that ....



    "Daryl M" <darylm4290@aol.com> wrote:
    >I have a simple application (consisting of a single form) that is basically
    >a background task with processing being triggered by the presence of a file.
    >What I want to do is prevent the app from being shut down by the user
    >through the Task Manager if the app is in the middle of a process.
    >
    >Looking at the help for the QueryUnload event, it says that the UnloadMode
    >will be set to a 3 if the Microsoft Task Manager is closing the application.
    >When I close my app with the Task Manager, it does not go through the form's
    >QueryUnload event at all.
    >
    >Am I doing something wrong, or is this dependant on the operating system?

    I
    >have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
    >
    >



  3. #3
    Karl E. Peterson Guest

    Re: UnloadMode in QueryUnload Event

    Hi Daryl --

    > I have a simple application (consisting of a single form) that is basically
    > a background task with processing being triggered by the presence of a file.
    > What I want to do is prevent the app from being shut down by the user
    > through the Task Manager if the app is in the middle of a process.
    >
    > Looking at the help for the QueryUnload event, it says that the UnloadMode
    > will be set to a 3 if the Microsoft Task Manager is closing the application.
    > When I close my app with the Task Manager, it does not go through the form's
    > QueryUnload event at all.
    >
    > Am I doing something wrong, or is this dependant on the operating system? I
    > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA


    I just tried in Win2000, and it worked just fine. Here's the complete code:

    Option Explicit

    Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
    MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
    End Sub

    Thinking something amiss, I also tried running it from an NT4 server, and an NT4
    workstation. In all cases, selecting "End Task" produced the desired results.

    When I went to the Processes tab, and selected "End Process", it did what you
    describe. You really can't prevent that, and that's why TaskMan throws up a warning
    and asks you if you're sure that's what you want to do. This is the difference
    between WM_CLOSE and TerminateProcess. If you're unsure I may be right, see the MSDN
    docs on the latter API call.

    Later... Karl
    --
    http://www.mvps.org/vb



  4. #4
    mrfelis Guest

    Re: UnloadMode in QueryUnload Event

    THis works on Win 98 as well.

    --
    ~~~
    !ti timda I ,KO
    ..em deppals nocaeB sivaM
    !draH
    ~~
    C'Ya,
    mrfelis@yahoo!com
    Karl E. Peterson <karl@mvps.org> wrote in message
    news:3a381935$1@news.devx.com...
    > Hi Daryl --
    >
    > > I have a simple application (consisting of a single form) that is

    basically
    > > a background task with processing being triggered by the presence of a

    file.
    > > What I want to do is prevent the app from being shut down by the user
    > > through the Task Manager if the app is in the middle of a process.
    > >
    > > Looking at the help for the QueryUnload event, it says that the

    UnloadMode
    > > will be set to a 3 if the Microsoft Task Manager is closing the

    application.
    > > When I close my app with the Task Manager, it does not go through the

    form's
    > > QueryUnload event at all.
    > >
    > > Am I doing something wrong, or is this dependant on the operating

    system? I
    > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA

    >
    > I just tried in Win2000, and it worked just fine. Here's the complete

    code:
    >
    > Option Explicit
    >
    > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
    > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
    > End Sub
    >
    > Thinking something amiss, I also tried running it from an NT4 server, and

    an NT4
    > workstation. In all cases, selecting "End Task" produced the desired

    results.
    >
    > When I went to the Processes tab, and selected "End Process", it did what

    you
    > describe. You really can't prevent that, and that's why TaskMan throws up

    a warning
    > and asks you if you're sure that's what you want to do. This is the

    difference
    > between WM_CLOSE and TerminateProcess. If you're unsure I may be right,

    see the MSDN
    > docs on the latter API call.
    >
    > Later... Karl
    > --
    > http://www.mvps.org/vb
    >
    >




  5. #5
    Daryl M Guest

    Re: UnloadMode in QueryUnload Event

    Karl,

    Thanks for the response. You are correct about End Task firing the
    QueryUnload event. I also had a messagebox in the QueryUnload event, and the
    reason I didn't think the QueryUnload event was fired was that when the Task
    Manager window was displayed and I selected End Task, then the msgbox from
    the QueryUnload event was displayed, but it was behind the Task Manager
    window (it does not come to the foreground). And since I didn't respond to
    the msgbox, the Task Manager thinks the program is not responding, so it
    throws up another message asking whether to Wait, End Task or Cancel. Of
    course when I select End Task again the program terminates (which appears to
    use the same method as End Process).

    I tried setting Cancel = True if UnloadMode = 3 (which should in effect
    prevent the user from using End Task), but the Task Manager will still put
    up the second dialog asking whether to Wait, End Task or Cancel. So even
    though I can detect if the app is being closed with Task Manager (with End
    Task), the second dialog box appears and uses the End Process if the user
    selects End Task, which of course defeats the whole process of trying to
    prevent the shut down of the app. Any ideas on how to prevent this?




    "Karl E. Peterson" <karl@mvps.org> wrote in message
    news:3a381935$1@news.devx.com...
    > Hi Daryl --
    >
    > > I have a simple application (consisting of a single form) that is

    basically
    > > a background task with processing being triggered by the presence of a

    file.
    > > What I want to do is prevent the app from being shut down by the user
    > > through the Task Manager if the app is in the middle of a process.
    > >
    > > Looking at the help for the QueryUnload event, it says that the

    UnloadMode
    > > will be set to a 3 if the Microsoft Task Manager is closing the

    application.
    > > When I close my app with the Task Manager, it does not go through the

    form's
    > > QueryUnload event at all.
    > >
    > > Am I doing something wrong, or is this dependant on the operating

    system? I
    > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA

    >
    > I just tried in Win2000, and it worked just fine. Here's the complete

    code:
    >
    > Option Explicit
    >
    > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
    > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
    > End Sub
    >
    > Thinking something amiss, I also tried running it from an NT4 server, and

    an NT4
    > workstation. In all cases, selecting "End Task" produced the desired

    results.
    >
    > When I went to the Processes tab, and selected "End Process", it did what

    you
    > describe. You really can't prevent that, and that's why TaskMan throws up

    a warning
    > and asks you if you're sure that's what you want to do. This is the

    difference
    > between WM_CLOSE and TerminateProcess. If you're unsure I may be right,

    see the MSDN
    > docs on the latter API call.
    >
    > Later... Karl
    > --
    > http://www.mvps.org/vb
    >
    >




  6. #6
    Karl E. Peterson Guest

    Re: UnloadMode in QueryUnload Event

    Hi Daryl --

    Yeah, I can see how that would be. TaskMan starts out polite, and becomes
    increasingly rude with non-responsive apps. It definitely considers msgbox's to be
    impediments to progress. So, a WM_CLOSE is sent with SendMessageTimeout, and that
    failing, it asks whether to throw a TerminateProcess at it. Afaik, there is no way
    to prevent this call from success, short of preventing a process from obtaining
    PROCESS_TERMINATE rights. TaskMan operates in a rather priviledged environment, and
    generally succeeds at obtaining these rights, when it asks. There _may_ be some
    potential way of averting this by fiddling with SetSecurityInfo, but that just looks
    mondo-nasty on the face of it. At any rate, that'd be the avenue to pursue.

    Good luck... Karl
    --
    http://www.mvps.org/vb


    "Daryl M" <darylm4290@aol.com> wrote in message news:3a38e5c4@news.devx.com...
    > Karl,
    >
    > Thanks for the response. You are correct about End Task firing the
    > QueryUnload event. I also had a messagebox in the QueryUnload event, and the
    > reason I didn't think the QueryUnload event was fired was that when the Task
    > Manager window was displayed and I selected End Task, then the msgbox from
    > the QueryUnload event was displayed, but it was behind the Task Manager
    > window (it does not come to the foreground). And since I didn't respond to
    > the msgbox, the Task Manager thinks the program is not responding, so it
    > throws up another message asking whether to Wait, End Task or Cancel. Of
    > course when I select End Task again the program terminates (which appears to
    > use the same method as End Process).
    >
    > I tried setting Cancel = True if UnloadMode = 3 (which should in effect
    > prevent the user from using End Task), but the Task Manager will still put
    > up the second dialog asking whether to Wait, End Task or Cancel. So even
    > though I can detect if the app is being closed with Task Manager (with End
    > Task), the second dialog box appears and uses the End Process if the user
    > selects End Task, which of course defeats the whole process of trying to
    > prevent the shut down of the app. Any ideas on how to prevent this?
    >
    >
    >
    >
    > "Karl E. Peterson" <karl@mvps.org> wrote in message
    > news:3a381935$1@news.devx.com...
    > > Hi Daryl --
    > >
    > > > I have a simple application (consisting of a single form) that is

    > basically
    > > > a background task with processing being triggered by the presence of a

    > file.
    > > > What I want to do is prevent the app from being shut down by the user
    > > > through the Task Manager if the app is in the middle of a process.
    > > >
    > > > Looking at the help for the QueryUnload event, it says that the

    > UnloadMode
    > > > will be set to a 3 if the Microsoft Task Manager is closing the

    > application.
    > > > When I close my app with the Task Manager, it does not go through the

    > form's
    > > > QueryUnload event at all.
    > > >
    > > > Am I doing something wrong, or is this dependant on the operating

    > system? I
    > > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA

    > >
    > > I just tried in Win2000, and it worked just fine. Here's the complete

    > code:
    > >
    > > Option Explicit
    > >
    > > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
    > > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
    > > End Sub
    > >
    > > Thinking something amiss, I also tried running it from an NT4 server, and

    > an NT4
    > > workstation. In all cases, selecting "End Task" produced the desired

    > results.
    > >
    > > When I went to the Processes tab, and selected "End Process", it did what

    > you
    > > describe. You really can't prevent that, and that's why TaskMan throws up

    > a warning
    > > and asks you if you're sure that's what you want to do. This is the

    > difference
    > > between WM_CLOSE and TerminateProcess. If you're unsure I may be right,

    > see the MSDN
    > > docs on the latter API call.
    > >
    > > Later... Karl
    > > --
    > > http://www.mvps.org/vb
    > >
    > >

    >
    >



  7. #7
    Daryl M Guest

    Re: UnloadMode in QueryUnload Event

    Thanks again for the info. I think this is just going to have to be a
    training issue and be treated the same as if the power to the machine is
    turned off.


    "Karl E. Peterson" <karl@mvps.org> wrote in message
    news:3a3903d6$1@news.devx.com...
    > Hi Daryl --
    >
    > Yeah, I can see how that would be. TaskMan starts out polite, and becomes
    > increasingly rude with non-responsive apps. It definitely considers

    msgbox's to be
    > impediments to progress. So, a WM_CLOSE is sent with SendMessageTimeout,

    and that
    > failing, it asks whether to throw a TerminateProcess at it. Afaik, there

    is no way
    > to prevent this call from success, short of preventing a process from

    obtaining
    > PROCESS_TERMINATE rights. TaskMan operates in a rather priviledged

    environment, and
    > generally succeeds at obtaining these rights, when it asks. There _may_

    be some
    > potential way of averting this by fiddling with SetSecurityInfo, but that

    just looks
    > mondo-nasty on the face of it. At any rate, that'd be the avenue to

    pursue.
    >
    > Good luck... Karl
    > --
    > http://www.mvps.org/vb
    >
    >
    > "Daryl M" <darylm4290@aol.com> wrote in message

    news:3a38e5c4@news.devx.com...
    > > Karl,
    > >
    > > Thanks for the response. You are correct about End Task firing the
    > > QueryUnload event. I also had a messagebox in the QueryUnload event, and

    the
    > > reason I didn't think the QueryUnload event was fired was that when the

    Task
    > > Manager window was displayed and I selected End Task, then the msgbox

    from
    > > the QueryUnload event was displayed, but it was behind the Task Manager
    > > window (it does not come to the foreground). And since I didn't respond

    to
    > > the msgbox, the Task Manager thinks the program is not responding, so it
    > > throws up another message asking whether to Wait, End Task or Cancel. Of
    > > course when I select End Task again the program terminates (which

    appears to
    > > use the same method as End Process).
    > >
    > > I tried setting Cancel = True if UnloadMode = 3 (which should in effect
    > > prevent the user from using End Task), but the Task Manager will still

    put
    > > up the second dialog asking whether to Wait, End Task or Cancel. So even
    > > though I can detect if the app is being closed with Task Manager (with

    End
    > > Task), the second dialog box appears and uses the End Process if the

    user
    > > selects End Task, which of course defeats the whole process of trying to
    > > prevent the shut down of the app. Any ideas on how to prevent this?
    > >
    > >
    > >
    > >
    > > "Karl E. Peterson" <karl@mvps.org> wrote in message
    > > news:3a381935$1@news.devx.com...
    > > > Hi Daryl --
    > > >
    > > > > I have a simple application (consisting of a single form) that is

    > > basically
    > > > > a background task with processing being triggered by the presence of

    a
    > > file.
    > > > > What I want to do is prevent the app from being shut down by the

    user
    > > > > through the Task Manager if the app is in the middle of a process.
    > > > >
    > > > > Looking at the help for the QueryUnload event, it says that the

    > > UnloadMode
    > > > > will be set to a 3 if the Microsoft Task Manager is closing the

    > > application.
    > > > > When I close my app with the Task Manager, it does not go through

    the
    > > form's
    > > > > QueryUnload event at all.
    > > > >
    > > > > Am I doing something wrong, or is this dependant on the operating

    > > system? I
    > > > > have NT 4.0 SP 5. Maybe this only works under Windows 95/98 ?? TIA
    > > >
    > > > I just tried in Win2000, and it worked just fine. Here's the complete

    > > code:
    > > >
    > > > Option Explicit
    > > >
    > > > Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As

    Integer)
    > > > MsgBox "UnloadMode:" & UnloadMode, vbCritical, "Unloading"
    > > > End Sub
    > > >
    > > > Thinking something amiss, I also tried running it from an NT4 server,

    and
    > > an NT4
    > > > workstation. In all cases, selecting "End Task" produced the desired

    > > results.
    > > >
    > > > When I went to the Processes tab, and selected "End Process", it did

    what
    > > you
    > > > describe. You really can't prevent that, and that's why TaskMan

    throws up
    > > a warning
    > > > and asks you if you're sure that's what you want to do. This is the

    > > difference
    > > > between WM_CLOSE and TerminateProcess. If you're unsure I may be

    right,
    > > see the MSDN
    > > > docs on the latter API call.
    > > >
    > > > Later... Karl
    > > > --
    > > > http://www.mvps.org/vb
    > > >
    > > >

    > >
    > >

    >




  8. #8
    Karl E. Peterson Guest

    Re: UnloadMode in QueryUnload Event

    Hi Daryl --

    > Thanks again for the info. I think this is just going to have to be a
    > training issue and be treated the same as if the power to the machine is
    > turned off.


    I think that's a really good way to look at it. I asked a fellow who I consider to
    be *tops* in the field and this was his response:

    >you'd have to change the DACL -- but that still leaves a hole: a
    >determined killer who was launched by the same user might use its owner
    >privilege to rewrite the DACL, giving himself terminate permission, and
    >then reopen the target process. Finally, admin and SYSTEM can take
    >ownership and then rewrite the DACL.
    >
    >However, for most purposes, just fixing a DACL that grants nobody
    >PROCESS_TERMINATE access should do it.


    Followed by:

    >yes, taskmgr.exe runs as system, and no, it does not do any fancy
    >footwork. Just remember, though, that a process which has activated
    >SeDebugPrivilege can open _any_ other process with _any_ desired
    >permission -- no defense against that.


    Looking up SeDebugPrivilege in MSDN confirms there's no getting around these issues.
    See:

    HOWTO: Use the SeDebugPrivilege to Acquire Any Process Handle, ID: Q185215
    http://support.microsoft.com/support.../q185/2/15.asp

    for the cold reality.

    Later... Karl
    --
    http://www.mvps.org/vb



Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
HTML5 Development Center
 
 
FAQ
Latest Articles
Java
.NET
XML
Database
Enterprise
Questions? Contact us.
C++
Web Development
Wireless
Latest Tips
Open Source


   Development Centers

   -- Android Development Center
   -- Cloud Development Project Center
   -- HTML5 Development Center
   -- Windows Mobile Development Center