how to prevent automatic log off in windows 7

0

I have a remote machine that runs on Windows 7, it gets logoff by closing all running application and the gets logged in again automatically. It happens every day but not on specific time and without specific task.

enter image description here

After reviewing Event logs as shown above in image, i found few Events with Id 7001 & 7002 with task category 1101 and 1102 respectively.

I use Windows 7. We are suffering from this problem with other 3 machines having same configuration.

To resolve this, I searched on internet and applied the solution regarding customer experience which is mentioned in the link below:

User Logoff Notification for Customer Experience Improvement Program

Can anyone help me to track this issue ?? Am i on right direction to resolve this problem?

EDIT.

After suggestion given by @TwistyImpersonator, i can say following things from detailed Event viewer (Image are attached at the end):

In System events:

following events always occurred AFTER 'Winlog' events:

Service Control Manager-7036-None-The Shell Hardware Detection service entered the stopped state.

And in Application event, following events occurred around the same time frame

Warning-09.11.2017 18:19:29-User-Profile Service-1530-None-Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-1277090162-4221482773-868009429-3552: Process 272 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1277090162-4221482773-868009429-3552\Printers\DevModePerUser

Information-09.11.2017 18:19:29-Desktop Window Manager-9009-None-The Desktop Window Manager has exited with code (0x40010004)

System-and-application-Event-log-compare-1

System-and-application-Event-log-compare-2

Bunty

Posted 2017-11-13T13:31:36.410

Reputation: 1

Please include the details of the relevant events you've mentioned. What software is running on the machine that logs it back in automatically? Windows can't do that without 3rd party software. – I say Reinstate Monica – 2017-11-13T15:33:29.350

No 3rd party software is installed. Logs are viewed through Admin tools of Windows. I attach screenshot of log viewer. – Bunty – 2017-11-13T16:13:13.840

Is event ID 1074 logged in the System log when these logoffs occur? What is the text of that event? – I say Reinstate Monica – 2017-11-13T17:24:01.143

"it gets logoff by closing all running application" - does that mean you suspect that there is some unwanted sofware initiating the logoff when all running desktop applications are closed? – Harry – 2017-11-13T19:37:31.090

@TwistyImpersonator Event 1074 found around 'Winlogon Event 7001' only when user initiate manual restart. Otherwise no Event 1074 found! – Bunty – 2017-11-14T10:11:22.243

@Harry Sorry for my structure of English sentence, i don't suspect about any unwanted software. I mean to say is: " It (Windows) closes all running applications and then logs off, then auto logon and still remote connection is alive" Remote connection is alive means : no need to establish the connection, desktop of remote machine can be seen after (auto) logoff and logon. – Bunty – 2017-11-14T10:16:12.583

I don't think it's actually logging off the account. It might be that the Explorer shell is crashing or being restarted. – I say Reinstate Monica – 2017-11-14T12:20:38.483

@TwistyImpersonator To solve the solution, i can consider this as one of the possibility. If it is so, how can i detect and prevent the Explorer crash? It happens with ALL 3 remote machine in our network. By the way, there are no logs of system restart. – Bunty – 2017-11-14T13:13:13.153

I'm not suggesting the system is restarting, only Windows Explorer. Start by filtering the System and Application event log to show only warning and error events. Is anything interesting logged around the time the problem occurs? – I say Reinstate Monica – 2017-11-14T13:39:23.033

@TwistyImpersonator I ahve studied the Application and System logs around the time frame of 'Winlogon' and drew a conclusion. I have a edit the question. Please look at it. – Bunty – 2017-11-14T15:36:52.457

@TwistyImpersonator I have added a link to screenshots that compares system and application events near the time of winlogon – Bunty – 2017-11-14T16:06:16.223

@Harry that was first solution i adopted (and i mentioned with link in question as well) but didn't work. So,currently i am approaching the way suggested by 'TwistyImpersonator', this might be Explorer shell crashing problem. – Bunty – 2017-11-15T09:31:57.037

Hm everything is possible but explorer crashing would not log off nor would it close other applications. did you disable the scheduled tasks described here? Eventually better turn on scheduled task history as well so you see what if there was a scheduled task executed at the time of interest. Disable CEIP tasks: https://www.askvg.com/how-to-disallow-secret-customer-experience-improvement-program-collecting-information-in-windows-7/

– Harry – 2017-11-15T09:37:16.427

@TwistyImpersonator Today in the mornning i saw login screen of remote machine. I put it running yesterday night with some applications. Today, after login i did not any application open. It looks like it is not Explorer crash problem but log off issue. Because Explorer crash won't logoff system. Any idea how can i proceed? – Bunty – 2017-11-17T08:36:02.397

@Harry You are right. It seems not an Explorer crash problem, but log off issue. Yesterday i did the setting what you mentioned in link from your last post. Even though, today morning i see system was on login screen asking for password, after login there were no application open. How to proceed? I feel like i am lost.

– Bunty – 2017-11-17T08:39:19.480

i'll come up with something for you. did you meanwhile enable the history for the windows scheduled tasks? – Harry – 2017-11-17T19:04:51.780

i am trying to write an answer, meanwhile please try disabling CEIP by using GPO and all other methods described here: https://www.ghacks.net/2016/10/26/turn-off-the-windows-customer-experience-program/

– Harry – 2017-11-17T19:23:40.850

Answers

0

Before judging this answer please know that it is work in progress. The comments got too much and were not really dedicated on answerring the question but instead find the cause of the problem.

I cannot currently get hold of a copy of win7 to check how below code is working on win7, i'll do that next week, or you just tell me what you experience...

---- answer draft ----

Altough the best solution for your problem is to find the cause, i am going to answer the questions title:

"how to prevent automatic logoff in windows 7"

To capture and prevent logoff, the current way i found out was to catch the "formclosing" event of a windows form in C# and check if the CloseReason is CloseReason.WindowsShutDown. This event can then be "denied" by the code.

This is the whole code:

using System;
using System.Windows.Forms;
using System.IO;

namespace BlockLogoffForm
{
    public partial class PreventLogoff : Form
    {
        public PreventLogoff()
        {
            InitializeComponent();
        }

        private void PreventLogoff_FormClosing(object sender, FormClosingEventArgs e)
        {
            if (e.CloseReason.Equals(CloseReason.WindowsShutDown))
            {
                File.AppendAllText("c:\\temp\\logofflog.txt","log off prevented at " + DateTime.Now);
                e.Cancel = true;

            }
        }
    }
}

Download the compiled binary here: BlockLogoffForm.exe

At the current design, you would need to start this program and leave it running until the auto logoff actually happens. Further redefinitions could bring up the same running as Tasktray application or similar.

Harry

Posted 2017-11-13T13:31:36.410

Reputation: 359