Getting Process Desktop - windows

Question

As part of a project I'm making I create and use a new desktop by using CreateDesktop, SwitchDesktop, SetThreadDesktop... et al.
Once a new desktop is created and switched to a process is created via CreateProcess and the handle is stored so that when the desktop is closed I may terminate the process using TerminateProcess so that Windows can delete/close the desktop as all processes in a desktop must be terminated before the desktop can be closed.
However programs that use a file dialog open the user to executing arbitrary processes in the desktop, for example if I were to create a notepad.exe process for this desktop a user could click on File > Open navigate to %windir% and then execute explorer.exe which would actually open in the desktop giving it a taskbar, start button, and of course the ability to do anything they want.
The problem is that when something like this happens and the desktop is switched back to the main desktop my program only knows of and can terminate the processes it has started, leaving explorer.exe and any other processes left in the desktop to be in process limbo, preventing the desktop from being closed.
I was thinking about using EnumProcesses, then get a handle for each and hopefully finding a way to retrieve its desktop name so that I can compare it to mine and terminate the process.
Would this be the correct approach to this problem? If so what WinAPI function could I use to retrieve a process' desktop name? However if it is not the correct approach what can I do to fix, prevent, or mitigate this?

Answer 1

There are several approaches to solve your problem.
Like #eryksun said u can use EnumDesktopWindows to get all Top-Level windows and send them as WM_CLOSE Message. After that, you can use WaitForSingleObject or WaitForMultipleObjects with a timeout, so you can terminate them after the timeout. You can check the timeout with WAIT_TIMEOUT. Here is an example in python:
import win32api
import win32con
import win32event
import win32gui
import win32process
import win32service
def closeProcessesOnDesk(deskName,timeout):
print("try to close Processes on given Desktop")
hwndlist=[]
try:
hdesk = win32service.OpenDesktop(deskName,0,False,0)
hwndlist = hdesk.EnumDesktopWindows()
except Exception as ex:
print("Desktop wasn't found. {}".format(ex))
processlist =[]
#try to close nicely processes"
for hwnd in hwndlist:
# Get the window's process id's
if win32gui.IsWindowVisible(hwnd) and win32gui.IsWindowEnabled(hwnd):
tid, pid = win32process.GetWindowThreadProcessId(hwnd)
handle = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS, 0, pid)
processlist.append(handle)
# Ask window nicely to close
try:
win32gui.PostMessage(hwnd, win32con.WM_CLOSE, 0, 0)
except:
pass
# Allow some time for app to close
print("Start waiting for processes to close")
try:
state = win32event.WaitForMultipleObjects(processlist, True, timeout)
if state == win32con.WAIT_TIMEOUT:
print("processes didn't close nicely, terminate them")
except Exception as ex:
print("Error on closing Process. {}".format(ex))
finally:
for hproc in processlist:
if hproc:
win32api.TerminateProcess(hproc,0)
win32api.CloseHandle(hproc)
closeProcessesOnDesk('test',2000)
Since you have handle of your created Process, you can use it to terminate the whole processtree of this process. In your case every process which will be started with File > Open in notepad.exe will also be terminated. In python:
import subprocess
def killProcessTree(parent_pid):
try:
subprocess.call(['taskkill', '/F', '/T', '/PID', str(parent_pid)])
print("Process killed: %s " % str(parent_pid))
except Exception as ex:
print("Process was not killed %s" % ex
You can also create a new User with restricted rights so he is not even able to start another process. Use CreateProcessWithLogonW or CreateProcessAsUser to start the process as a "restricted User". But be careful, since winstations and Desktops are security objects you have to add the Users sid to the DACL of the desktop and winstation.