I have a remote machine that runs on Windows 7, it gets logoff by closing all running application and the gets logged in again automatically. It happens every day but not on specific time and without specific task.

enter image description here

After reviewing Event logs as shown above in image, i found few Events with Id 7001 & 7002 with task category 1101 and 1102 respectively.

I use Windows 7. We are suffering from this problem with other 3 machines having same configuration.

To resolve this, I searched on internet and applied the solution regarding customer experience which is mentioned in the link below:

User Logoff Notification for Customer Experience Improvement Program

Can anyone help me to track this issue ?? Am i on right direction to resolve this problem?


After suggestion given by @TwistyImpersonator, i can say following things from detailed Event viewer (Image are attached at the end):

In System events:

following events always occurred AFTER 'Winlog' events:

Service Control Manager-7036-None-The Shell Hardware Detection service entered the stopped state.

And in Application event, following events occurred around the same time frame

Warning-09.11.2017 18:19:29-User-Profile Service-1530-None-Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-1277090162-4221482773-868009429-3552: Process 272 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1277090162-4221482773-868009429-3552\Printers\DevModePerUser

Information-09.11.2017 18:19:29-Desktop Window Manager-9009-None-The Desktop Window Manager has exited with code (0x40010004)



  • Please include the details of the relevant events you've mentioned. What software is running on the machine that logs it back in automatically? Windows can't do that without 3rd party software. – I say Reinstate Monica Nov 13 '17 at 15:33
  • No 3rd party software is installed. Logs are viewed through Admin tools of Windows. I attach screenshot of log viewer. – Bunty Nov 13 '17 at 16:13
  • Is event ID 1074 logged in the System log when these logoffs occur? What is the text of that event? – I say Reinstate Monica Nov 13 '17 at 17:24
  • "it gets logoff by closing all running application" - does that mean you suspect that there is some unwanted sofware initiating the logoff when all running desktop applications are closed? – Harry Nov 13 '17 at 19:37
  • @TwistyImpersonator Event 1074 found around 'Winlogon Event 7001' only when user initiate manual restart. Otherwise no Event 1074 found! – Bunty Nov 14 '17 at 10:11

Before judging this answer please know that it is work in progress. The comments got too much and were not really dedicated on answerring the question but instead find the cause of the problem.

I cannot currently get hold of a copy of win7 to check how below code is working on win7, i'll do that next week, or you just tell me what you experience...

---- answer draft ----

Altough the best solution for your problem is to find the cause, i am going to answer the questions title:

"how to prevent automatic logoff in windows 7"

To capture and prevent logoff, the current way i found out was to catch the "formclosing" event of a windows form in C# and check if the CloseReason is CloseReason.WindowsShutDown. This event can then be "denied" by the code.

This is the whole code:

using System;
using System.Windows.Forms;
using System.IO;

namespace BlockLogoffForm
    public partial class PreventLogoff : Form
        public PreventLogoff()

        private void PreventLogoff_FormClosing(object sender, FormClosingEventArgs e)
            if (e.CloseReason.Equals(CloseReason.WindowsShutDown))
                File.AppendAllText("c:\\temp\\logofflog.txt","log off prevented at " + DateTime.Now);
                e.Cancel = true;


Download the compiled binary here: BlockLogoffForm.exe

At the current design, you would need to start this program and leave it running until the auto logoff actually happens. Further redefinitions could bring up the same running as Tasktray application or similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.