When logoff is occurring, all applications are shut down. They receive the same messages that they would receive when the system is shut down: WM_QUERYENDSESSION followed by WM_ENDSESSION. The lParam parameter has the EWX_REALLYLOGOFF bit set indicating that this is a logoff, not a shutdown. The messages are sent via BroadcastSystemMessage, so they are received by all top-level windows, installable drivers, and VxDs.
Most ordinary applications are not affected by logon and logoff, beyond the ordinary implications of active connections being disconnected and open files being closed. The primary purpose of this message is for network-specific applications which maintain internal state based on the current logon. For example, an application which receives messages from other stations might need to delete a NetBIOS name when the user logs off.
A service process that needs to stay running when the user logs off can call the RegisterServiceProcess API to make itself exempt from the automatic shutdown of all applications at logoff time.