title: Windows Logoff Capture with C
body: <p>I am attempting to use C to capture a logoff event on a Windows Server 2008 64 bit system. Currently I am using the console logoff event code illustrated here: <a href="http://www.cplusplus.com/forum/beginner/1501/" rel="nofollow">http://www.cplusplus.com/forum/beginner/1501/</a> (6th comment down by Grey Wolf, his second coding example) will be attached to the end of this post. </p>
  
  <p>There are several issues with this code. It works fine standalone and when the user starts the program. When I begin to add calls to some of our proprietary code it stops catching logoff events. No GUI code, this is all console. Anyone know anything that would stop this from working? It seems rather finicky. </p>
  
  <p>Also if the program is started by another program automatically during logon (started at the user level and same session ID as if you were to double click the .exe and activate it yourself) it also fails to capture the logoff event. Any ideas would be great.</p>
  
  <p>Examples: 
  This works fine standalone and if manually started by the user.</p>
  
  <pre><code>#include &lt;windows.h&gt;
  #include &lt;tchar.h&gt;
  #include &lt;signal.h&gt;
  
  
  BOOL WINAPI ConsoleHandler(
      DWORD dwCtrlType   //  control signal type
  );
  
  static int startup;
  
  int main(int argc, char *argv[])
  {
      if (SetConsoleCtrlHandler( (PHANDLER_ROUTINE)ConsoleHandler,TRUE)==FALSE)
      {
          // unable to install handler...
          // display message to the user
          printf("Unable to install handler!\n");
          return -1;
      }
  
      startup=1;
  
      while(1)
      {
  
      }
  }
  
  BOOL WINAPI ConsoleHandler(DWORD CEvent)
  {
      char mesg[128];
      static   FILE * pFile;
  
      char FileName[32] = "ControlHandle.txt";
      if(startup) {
          /* create the filename */
  
       pFile = fopen(FileName, "at");
       printf("creating a file\n");
  
      fprintf(pFile, "This file contains the message when a control character is received.\n\n\n");
      fclose(pFile);
      startup=0;
      }
  
      switch(CEvent)
      {
      case CTRL_C_EVENT:
          pFile = fopen(FileName, "at");
          if(pFile &gt; 0){
              printf("Got File Handle");
          }
  fprintf( pFile,"in handler got an CTRL_C_EVENTevent\n" );
  fclose(pFile);
          break;
      case CTRL_BREAK_EVENT:
  pFile = fopen(FileName, "at");
  fprintf( pFile,"in handler got an CTRL_BREAK_EVENTevent\n" );
  fclose(pFile);
          break;
      case CTRL_CLOSE_EVENT:
         pFile = fopen(FileName, "at");
  fprintf( pFile,"in handler got an CTRL_CLOSE_EVENTevent\n" );
  fclose(pFile);
          break;
      case CTRL_LOGOFF_EVENT:
          pFile = fopen(FileName, "at");
  fprintf( pFile,"in handler got an CTRL_LOGOFF_EVENTevent\n" );
  fclose(pFile);
          break;
      case CTRL_SHUTDOWN_EVENT:
          pFile = fopen(FileName, "at");
  fprintf( pFile,"in handler got an CTRL_SHUTDOWN_EVENTevent\n" );
  fclose(pFile);
          break;
  
      }
      return TRUE;
  }
  </code></pre>