実行中のプログラムがログオフ時にコードを実行するようにするには、メッセージをフックして(0x80000000)の値をWM_QUERYENDSESSION
探す必要があります。lParam
ENDSESSION_LOGOFF
It's important to test for this lParam
value because the other ones indicate a "forced close" - i.e. your process may be killed before your code is even allowed to run. In fact, most shutdown/session-end messages are only intended to give you an opportunity to run last-minute cleanup code and aren't that safe to respond to with long-running actions; but this particular combination should be OK.
Note: I've never tried to actually run a separate process in response to the WM_QUERYENDSESSION
message. It's possible that the window manager will disallow this, like it does during shutdown. Try it and see, I guess.
If you're in a .NET environment (you didn't specify), a quicker way is to add an event handler to the Microsoft.Win32.SystemEvents.SessionEnding
event.