When a logoff event occurs, the system notifies all processes in the system as follows:
All windows of processes in the logon session being logged off receive the WM_QUERYENDSESSION (0x0011) and WM_ENDSESSION (0x0016) messages. All windows on the desktops of the window station being logged off receive these messages, even if the windows belong to processes running in another logon session.