Difference in Logoff notification events between Windows XP and Windows 7

Question

I have a service / application which receives notifications of Windows session changes. I have noted a difference in behaviour between Windows XP and Windows 7 and am trying to establish if it is a bug or a documented change of behaviour.

The notifications come in as a: WTSSESSION_NOTIFICATION.

Windows XP reports as expected: WTS_SESSION_LOGON at windows GUI logon and: WTS_SESSION_LOGOFF at Windows GUI logoff.

Under Windows 7 x64 at gui login WTS_SESSION_LOGON is generated but at logoff I get a WTS_CONSOLE_DISCONNECT event instead of the WTS_SESSION_LOGOFF event.

Is this a bug or have the constant values changed between versions? It is not massively critical for the service I have developed but I would still like to know why this behaves differently.

Answer 1

Only services can receive the WTS_SESSION_LOGOFF event under Windows 7. By the time that the service gets the notification the log off procedure is over (so all apps the user was running are already killed).