By default, when an application uses ExitWindows or ExitWindowsEx to log off, the system sends the WM_QUERYENDSESSION message to each window. Applications agree to terminate by returning TRUE when they receive this message. If any application returns FALSE when processing this message, the log-off operation is canceled. If your application handles the WM_QUERYENDSESSION message, you can allow the user to cancel the log-off operation, even if another application or the system originated the end-session request. For an example, see How to Log Off the Current User.
When an application returns TRUE for WM_QUERYENDSESSION, it receives the WM_ENDSESSION message and it is terminated, regardless of how the other applications respond to the WM_QUERYENDSESSION message.
The system also sends the CTRL_LOGOFF_EVENT control signal to every process during a log-off operation. A console application can register a HandlerRoutine to process these messages.
If the process that called ExitWindowsEx is running in the logon session of the interactive user, all processes in the logon session are terminated. If the process calling ExitWindowsEx is in some other logon session, only the notifications are made; no processes are terminated.