Create GUI from Windows Service with a Network Log on

Question

I have been reading a lot about executing a GUI application from a Windows Service. The "Allow service to interact with desktop" check box worked for me when the Service runs as the SYSTEM user (I am using Windows XP). Now I need the Service to run as a User defined in a domain (from the network). Everything works fine (even if no user is logged into the machine) but the GUIs are not shown (even if the same network user is logged in!). I know that the GUIs are running, it's just that they are hidden. Why is that? Is there a way to show them if a user is logged on (like when created by the SYSTEM user and allowed interaction with desktop!) ? if so, would it work if the user logged in is not the same as the one the service is running on?

---

Edit:

@casperOne: I see your solution, and it is the same that people (even you) have been posting around. In my case though, I am sure I am running on a secure environment and ONLY one user will be logged into a machine at a time. Isn't there anything one can do to simply unhide the GUIs? Why would this work with the user SYSTEM allowing interaction with desktop and not with another user?

Answer 1

Your approach is completely wrong, and will not work when deployed on Vista.

Services should NEVER assume a login session with a desktop to interact with.

Rather, you should have a second application which is run when the user logs in (or some other point in time) which communicates with the service and then displays UI elements when it receives notifications/responses from the service.

See this other question (and answers) for further information:

http://stackoverflow.com/questions/466199/how-to-detect-if-a-window-can-be-shown

Answer 2

Short answer: No, you can't do this

Long answer: Noooooo.

Basically, Microsoft are making changes to further prevent this. As casperOne stated, you'll need to separate your UI components away from the service.

Answer 3

And even on XP it didn't work on non domain joined machines (if you have multiple users using Fast User Switching the popups showed up on either the wrong desktop or no desktop at all).

As to why Microsoft changed this, do a quick search for "Shatter Attack" - by isolating service code from the desktop they completely cut off this entire family of security vulnerabilities.