How can I ensure that Windows 2008 R2 will pass the SERVICE_CONTROL_PRESHUTDOWN control notification to a service

Question

I'm writing a service using plain C++ and the windows API and want it to receive the PRESHUTDOWN notifications which are available from Windows 2008 R2.

http://msdn.microsoft.com/en-us/library/windows/desktop/ms685996(v=vs.85).aspx

I want this service to handle pre-shutdown events and prevent the machine from finishing its shutdown for an arbitrary time.

My ServiceMain loops, logging out a message every 5 seconds.

I'm setting dwControlsAccepted to:

SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PRESHUTDOWN

I'm receiving the SERVICE_CONTROL_STOP notification in my ServiceControl callback just fine.

If I run my service, and call

sc query "MyService"

It says:

(STOPPABLE, NOT_PAUSABLE, ACCEPTS_PRESHUTDOWN)

I write an entry to the log file as soon as I receive any service control notification, before I even look at what it is.

When I shutdown, windows makes a point of saying "Stopping MyService" in big white letters on the screen, and waits for a bit, then completes shutdown.

However:

The main loop keeps writing to the log file. The log file contains no reference to any service control attempt.

Then windows gives up on closing my service and just kills it.

Now, if I do exactly the same thing, but register for SHUTDOWN instead of PRESHUTDOWN, I see all the notifications in the log file that I would expect to see (although can't extend the shutdown period, as we can't do that from the SHUTDOWN notification).

The only change to the code is the removal of the three letters "PRE" in the calls to set status.

I'm not even getting to the point where I can start incrementing dwCheckPoint - the windows subsystem isn't notifying me.

Windows knows I'm looking for pre-shutdown messages, as evidenced by "sc query", is there anything that can be preventing it from receiving the pre-shutdown message?

Relevant methods:

When reporting the status (SCM reports service as started, quite happily)

VOID ServiceReportStatus (DWORD dwCurrentState, DWORD dwWin32ExitCode, DWORD dwWaitHint)
{
    // Fill in the SERVICE_STATUS structure.
    g_serviceStatus.dwCurrentState = dwCurrentState;
    g_serviceStatus.dwWin32ExitCode = dwWin32ExitCode;
    g_serviceStatus.dwWaitHint = dwWaitHint;

    switch(dwCurrentState)
    {
    case SERVICE_START_PENDING:
    case SERVICE_STOP_PENDING:
    case SERVICE_CONTINUE_PENDING:
    case SERVICE_PAUSE_PENDING:
        g_serviceStatus.dwControlsAccepted = 0;
        break;
    default:
        g_serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PRESHUTDOWN;
    }

    // Report the status of the service to the SCM.
    SetServiceStatus (g_serviceStatusHandle, &g_serviceStatus);
}

When I receive a message:

VOID WINAPI ServiceCtrlHandler (DWORD dwCtrl)
{
    LOG(eDeveloper10, L"ServiceCtrlHandler", L"Decoding SvcControl %d\n", dwCtrl);
   switch(dwCtrl) 
   {
      case SERVICE_CONTROL_PRESHUTDOWN:
          {
             LOG(eDeveloper10, L"ServiceCtrlHandler", L"Received SERVICE_CONTROL_PRESHUTDOWN\n");
             ServiceReportStatus(SERVICE_STOP_PENDING, NO_ERROR, 10000);

             // Signal the service to stop.
             SetEvent(g_serviceStopEvent);
             break;
          }
    }
}

It does more, but nothing useful for this example, as I don't even see the log (unless I'm registering for SHUTDOWN instead).

The ServiceCtrlHandler always returns quickly, I'm not blocking in here, I'm not getting in to here for the pre-shutdown handler. Registering for both PRESHUTDOWN and SHUTDOWN doesn't help either. I've tried this on two Windows 2008R2 machines, one virtual machine, one physical, with the same results. Service is compiled as a x64 binary.

Any ideas?

Some sample logs, this log is when I request to be notified of SHUTDOWN:

L0  T2672 2781140 [CDbgEntry::LoadSystemDetails()] System Details Follow:

   Computer Name     : \\****
   Domain/Workgroup  : **** [Domain]
   User Name         : SYSTEM
   Operating System  : Windows NT Version 6.1 Build 7600
   Service Pack      : None.    
   Terminal Services : Terminal Services Present
   System Root       : C:\Windows\system32
   User's Windir     : C:\Windows


This file is recording debug messages with a maximum level of 10
L10 T2672 2781140 [ServiceInitialize] Service initialised, waiting for stop event
L10 T2672 2786140 [ServiceInitialize] Still waiting for stop event.
L10 T2668 2789328 [ServiceCtrlHandler] Decoding SvcControl 5
L10 T2668 2789328 [ServiceCtrlHandler] Received SERVICE_CONTROL_SHUTDOWN
L10 T2672 2789328 [ServiceInitialize] Stop event detected
L10 T2672 2789328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2790328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2791328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2792328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2793328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2794328 [ServiceInitialize] Blocking service shutdown
L10 T2672 2795437 [ServiceInitialize] Blocking service shutdown
L10 T2672 2796437 [ServiceInitialize] Blocking service shutdown

Note that the Blocking Service shutdown is the correct behaviour in this particular case.

If I register for PRESHUTDOWN, I get nothing from the ServiceCtrlHandler at all:

L0  T2244 516625 [CDbgEntry::LoadSystemDetails()] System Details Follow:

   Computer Name     : \\****
   Domain/Workgroup  : **** [Domain]
   User Name         : SYSTEM
   Operating System  : Windows NT Version 6.1 Build 7600
   Service Pack      : None.
   Terminal Services : Terminal Services Present
   System Root       : C:\Windows\system32
   User's Windir     : C:\Windows


This file is recording debug messages with a maximum level of 10
L10 T2244 516453 [ServiceInitialize] Service initialised, waiting for stop event
L10 T2244 521625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 526625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 531625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 536625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 541625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 546625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 551625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 556625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 561625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 566625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 571625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 576625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 581625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 586625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 591625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 596625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 601625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 606625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 611625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 616625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 621625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 626625 [ServiceInitialize] Still waiting for stop event.
L10 T2244 631625 [ServiceInitialize] Still waiting for stop event.

No events whatsoever, until windows gives up and kills it.

Answer 1

According to the documentation , SERVICE_CONTROL_PRESHUTDOWN is only sent to the extended callback . Try using RegisterServiceCtrlHandlerEx .