Logoff and logoff processes/scripts

[dspent]

We use a desktop management application called Desktop Authority from Scriptologic Corp. to do various desktop management functions (i.e. map drives, push software installs, install printers etc...). Some of the functions we use it for are performed at logon, some once the desktop loads and others run at logoff.

Apparently there is a process called SLAGENT.EXE that runs constantly and when a user clicks the Windows logoff button, SLAGENT.EXE somehow knows it was clicked and then interrupts the Windows logoff/shutdown process, runs whatever logoff functions are given for that machine/user and then returns the focus back to the windows logoff/shutdown process allowing it to complete and log the user off or shut the pc down.

OK....now here's the problem. We recently deployed a new Single Sign-On application in the facility that employs its own logoff button. This button, when clicked runs Shutdown.EXE -L (which is Windows XP's native shutdown executable)... However, when you log off or shutdown using this button, it is as if SLAGENT.EXE either gets killed and never recognizes that windows is logging off and so never performs its function to kick of the logoff scripting OR gets bypassed or never realizes that windows is logging off.

To deal with this, I wrote the following:

Send( "{LWIN}", "_logoff1")
Send( "l", "_logoff1")
Send( "l", "_logoff2")

Func _logoff1 ()
send("{LWIN}"); Left Windows key 
sleep(50)
send("l"); Sends 'L' to Log off
sleep(50)
EndFunc

Func _logoff2 ()
send("l"); Sends 'L' again to confirm log-off
sleep(50)
send("{ENTER}"); Sometimes a dialog box comes up in WinXP: 
                       ; Other users are currently logged on, are you sure you want to log off?
ProcessWaitClose("slagent.exe")
EndFunc

This seems to work.... But there is a snag.

This only works if the user's has the default windows XP shell. If the user has changed their shell to the Classic Shell, then the following problem occurs:

the keys to send would be LWIN - U - ENTER (assuming Log off XXXXX was in the drop down where XXXXX is the username)

A 2nd problem is, if the user is using Windows 2000, the keys to send are LWIN - U - Y

Also even though I used ProcessWaitClose("Slagent.exe") AND I do see the slagent.exe window pop up briefly, I can't tell whether it is actually performing its logoff functions.

Basically I need to be able to write an executable for this Single Sign On application where their logoff button will kick off the Windows logoff process and allow SLAGENT.EXE (OR any logoff script, group policy logoff scripts etc.) to run without being bypassed.

I hope all this makes sense and that someone has had to tackle a similar situation. I need help desperately.

Thanks,

-Jones

[gamerman2360]

Hmm.. If you run SLAGENT.EXE does it do anything? Are there commands you could put in to shutdown/logoff the computer?

If not you could just make a script for it..

You could set a script to run when shutdown.exe is run by using this key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path

You could have the script run SLAGENT.EXE then shutdown the computer using Shutdown(). Pretty sure the computer's way of shutting down/logging off and Shutdown() don't use shutdown.exe.

Setting the key would look something like this:

If @Compiled Then
    RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe", "Debugger", "REG_SZ", @ScriptFullPath)
Else
    RegWrite("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe", "Debugger", "REG_SZ", @AutoItExe & " /AutoItExecuteScript """ & @ScriptFullPath & """")
EndIf

[dspent]

Well... SLAGENT.EXE is always running as a windows process. My guess is its watching application and user actions waiting to act when necessary (Like logoff and logon).

I actually spoke with support from Scriptlogic and this is what they had to say....

The process that the slagent looks for during a log off is the actual process of start>log off. What happens is that the slagent detects this process and intercepts the process before it goes to windows. Once the slagent runs the log off script, then it passes the process back to windows to finish it.

Now what I need to know (and what they did not tell me) was what that process is or how they detect it rather. If I knew that, I could write my logoff script to do the same thing that SLAGENT would then detect and do its thing.

Any help is appreciated. Thanks.

-Jones

[dspent]

I think I may have found the Windows function that is called when you click the logoff button...

InitiateSystemShutdown()

Found this at http://msdn2.microsoft.com/en-us/library/aa376873.aspx

However I now have no idea how to use AutoIT to write a script that will call this Windows Function....

Anyone have an idea?

Thanks,

-Jones

[PsaltyDS]

I think it would be more like determining how your script handled this message: WM_QUERYENDSESSION

Your script would run in the background until it received the WM_QUERYENDSESSION message from the system, and would then perform whatever functions you wanted before it returned the TRUE response that is required for "well behaved" programs.

The catch is, this likely handled already by the AutoIt interpreter and I don't know if you can script your own handling for it.

[Klexen]

how about

Func logoff()

Run("shutdown -l -f")

Endfunc

?

Edited August 12, 2007 by Klexen

[VeeDub]

@dspent

I can see a couple of ways you could approach this:

First, AutoIt has a function call Shutdown.

It would be worth creating a simple script to call this function and see whether SLAGENT.EXE detects that as a "shutdown event" and then performs it's processing.

If so, then if the the Single Sign-On application has an option to run a script on shutdown / logoff ... you could use your script to trigger SLAGENT into action.

Alternatively you could try using Group Policy to run your script on shutdown / logoff.

Since these sound like commercial programs I would concentrate on getting one of the vendors to help you out. Presumably Scriptologic Corp ought to be best placed to modify their SLAGENT "monitoring" if you organised a trial copy of the Single Sign-on software for them you would think they ought to be able to provide you with an updated version that works with the Single Sign-on software

VW

Edited August 12, 2007 by VeeDub

[dspent]

Since these sound like commercial programs I would concentrate on getting one of the vendors to help you out. Presumably Scriptologic Corp ought to be best placed to modify their SLAGENT "monitoring" if you organised a trial copy of the Single Sign-on software for them you would think they ought to be able to provide you with an updated version that works with the Single Sign-on software

VW

Well at this point that's where I am with this. I have a couple developers from the vendor working on this problem because I believe (and I communicated this to them) that this is a major oversight in their application's functionality. I mean if they are watching for shutdown events in order to trigger logoff/shutdown actions, they have to make sure they catch ALL logoff/Shutdown events. They are a good company with excellent support so I am sure they will either patch the application, supply me with a workaround or make this something they include in the next version which they release pretty regularly. I thank you all for your comments.