Event Handler Function Prototype callback function

Article
01/07/2021

[Event Handler Prototype functions are no longer available for use as of Windows Server 2008 and Windows Vista. ]

Event Handler Prototype functions are used for all functions that handle Winlogon notification events. The name of the function, represented below by the place holder Event_Handler_Function_Name, typically reflects the name of the event that the function handles. For example, the function that handles logon events might be named: WLEventLogon.

Syntax

void Event_Handler_Function_Name(
  _In_ PWLX_NOTIFICATION_INFO pInfo
);

Parameters

pInfo [in]: A pointer to a WLX_NOTIFICATION_INFO structure that contains the details of the event.

Return value

This callback function does not return a value.

Remarks

If your event handler needs to create child processes, it should call the CreateProcessAsUser function. Otherwise, the new process will be created on the Winlogon desktop, not the user's desktop.

Examples

The following sample shows how to implement event handlers for Winlogon events. For simplicity, only the implementations of the Logon and Logoff event handlers are shown. You can implement handlers for the rest of the events in exactly the same manner.

// Copyright (C) Microsoft. All rights reserved. 
#include <windows.h>

// Here is the entrance function for the DLL.
BOOL WINAPI LibMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
    switch (dwReason)
    {
        case DLL_PROCESS_ATTACH:
            {

             // Disable DLL_THREAD_ATTACH & DLL_THREAD_DETACH
             // notification calls. This is a performance optimization
             // for multithreaded applications that do not need 
             // thread-level notifications of attachment or
             // detachment.

            DisableThreadLibraryCalls (hInstance);
            }
            break;
    }

    return TRUE;
}

// Here is the event handler for the Winlogon Logon event.
void WLEventLogon (PWLX_NOTIFICATION_INFO pInfo)
{

    // Print the name of the handler to debug output.
    // You can replace this with more useful functionality.
    OutputDebugString (TEXT("NOTIFY:  Entering WLEventLogon.\r\n"));
}

// Here is the event handler for the Winlogon Logoff event.
void WLEventLogoff (PWLX_NOTIFICATION_INFO pInfo)
{

    // Print the name of the handler to debug output.
    // You can replace this with more useful functionality.
    OutputDebugString (TEXT("NOTIFY:  Entering WLEventLogff.\r\n"));
}

Requirements

Requirement	Value
Minimum supported client	Windows XP [desktop apps only]
Minimum supported server	Windows Server 2003 [desktop apps only]
End of client support	Windows XP
End of server support	Windows Server 2003

Share via