Event Handler Function Prototype

The following prototype is used for all functions that handle Winlogon notification events. The name of the function, represented below by the place holder, FunctionName, typically reflects the name of the event that the function handles. For example, the function that handles logon events might be named: WLEventLogon.

VOID <FunctionName> (
  PWLX_NOTIFICATION_INFO pInfo
);

Parameters

pInfo

Pointer to a WLX_NOTIFICATION_INFO structure which contains the details of the event.

Return Values

None.

Remarks

If your event handler needs to create child processes, it should call the CreateProcessAsUser function. Otherwise the new process will be created on the Winlogon desktop, not the user's desktop.

Example Code

The following example illustrates how to implement event handlers for Winlogon events. For simplicity, only the implementations of the Logon and Logoff event handlers are shown. You can implement handlers for the rest of the events in exactly the same manner.

//Entrance function for the DLL
BOOL WINAPI LibMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
    switch (dwReason)
    {
        case DLL_PROCESS_ATTACH:
            {
             //Disable DLL_THREAD_ATTACH & DLL_THREAD_DETACH
             //notification calls. This is a performance optimization
             //for multi-threaded applications that do not need 
             //thread-level notifications of attachment or detachment.

            DisableThreadLibraryCalls (hInstance);
            }
            break;
    }

    return TRUE;
}

//Event handler for the Winlogon Logon event
VOID WLEventLogon (PWLX_NOTIFICATION_INFO pInfo)
{
    //Print the name of the handler to debug output.
    //You can replace this with more useful functionality.
    OutputDebugString (TEXT("NOTIFY:  Entering WLEventLogon.\r\n"));
}

//Event handler for the Winlogon Logoff event.
VOID WLEventLogoff (PWLX_NOTIFICATION_INFO pInfo)
{
    //Print the name of the handler to debug output.
    //You can replace this with more useful functionality.
    OutputDebugString (TEXT("NOTIFY:  Entering WLEventLogff.\r\n"));
}