Windows Services and Windows 7

What are Windows Services?
A service is an integral mechanism built into Microsoft Windows operating systems. You can think of services as “special applications” that run with no regard to the current user context. Services are different from “regular” user applications because you can configure a service to run from the time a system starts up (boots) until it shuts down, without requiring an active user to be present – that is, services can run without having any users logged on.

We like to think about services as running “tasks” for us in the background without interfering with user operations. Services on Windows are responsible for all kinds of background activity that do not involve the user, ranging from the Remote Procedure Call (RPC) service, through Printer Spoolers, to the Network Location Awareness service.

What’s the problem?
Some services may attempt to display user interface dialogs or communicate with user applications. Such functionality is “typical” of Windows XP services, mainly because it is easy to do so. If you happen to own a service that attempts to display some user interface objects, like a dialog box, or tries to communicate with applications you might run into trouble running on Windows 7.

To be more specific, when running on Windows 7, your service may experiences one or more of the following symptoms. The service:

1. Is running, but cannot do what it is supposed to do, and just eats CPU cycles and memory

2.Is running, but other processes can't communicate with it and it cannot communicate with the user, or other applications / services

3. Is trying to communicate with user applications through window messages, but the window messages are not reaching their destination

4.Displays a flashing icon on the taskbar indicating the service wants to interact with the desktop

All the above symptoms point to the conclusion that your service is experiencing Session 0 Isolation of Windows 7 Services, that is, the “physical” separation between services and user applications, but more about that in just a bit. However, the main reason for isolating services from user application is making it harder for malicious software to run with elevated privileges, which enables them to do far more harm than running as standard user as explained in the following section, thus making Windows much more secure operating system.

First, let’s define the two “buckets of issues” your services may experience when running on Windows 7 -

1. The service fails to display a UI or it displays a mitigation UI (or annoying flashing dialog box)

2. Objects shared by services and applications become invisible or inaccessible

Starting with Windows Vista, only services are hosted in Session 0. User applications are isolated from services, and run in subsequent sessions created when users log onto the system: Session 1 for the first logged on user, Session 2 for the second, and so on ...

Entities (applications or services) running in different sessions cannot send each other messages, share UI elements, or share kernel objects without explicitly qualifying them to the global namespace and providing the appropriate access control settings.You can find additional valuable information about this in Impact of Session 0 Isolation on Services and Drivers in Windows Vista(http://www.microsoft.com/whdc/system/vista/services.mspx), an article that is equally applicable to Windows 7.

Here are some ideas on how to solve the above mentioned problems:

1. If a service needs to interact with the user by sending a message, use the WTSSendMessage function. It is almost identical in functionality to a MessageBox. This will provide an adequate and simple solution to services that do not require an elaborate UI, and is secure because the displayed message box cannot be used to take control of the underlying service.

2. If your service requires a more elaborate UI, use the CreateProcessAsUser function to create a process in the requesting user’s desktop Note that you will still need to communicate between the newly created process and the original services, which is where the next bullet point kicks in.

3. If two-way interaction is required, use Windows Communication Foundation (WCF), .NET remoting, named pipes, or any other interprocess communication (IPC) mechanism (excluding window messages) to communicate across sessions. WCF and Remoting have a better security enforcement that will prompt the user (assuming UAC not shut-off) to elevate if needed.

4. Ensure that kernel objects meant to be shared across sessions have names prefixed with the Global\ string, indicating that they belong in a session-global namespace.

ref:
http://windowsteamblog.com/blogs/developers/default.aspx