How do identify a (rogue?) application which is invoking "DDE Server"

By jpivonka ·
An occasional user logs into the Visitor account on this Windows XP SP3 machine. After that user has gone, logging off of the Visitor account is interrupted by the "DDE Server is being shut down" message.

The DDE functions are disabled in Services, so it is probably not running.

My guess is that Windows shutdown is delayed by its attempt to shut down a service that another program has attempted to start, but which is not being run, and has never completed the startup process.

The user of the Visitor account closes the applications he uses when he leaves the ocmputer, but that apparently does not notify Windows to stop attempting to run the DDE Server Window.

Two questions:

1) Is the assumption that the shutdown of a disabled & non started DDE server results in the message reasonable?
2) How do I identify what program is invoking and attempting to use the "Windows DDE Server?

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

Is this user an authorized user?

by robo_dev In reply to How do identify a (rogue? ...

Are they logging in remotely or locally?

Application usage monitoring tool:

Collapse -

Locally, but in circumstances where

by jpivonka In reply to Is this user an authorize ...

Locally, but in circumstances where control and close review of activity is infeasible. I'll discuss the need to keep records of application use if I can determine that those records will be usable in determining why Windows is attempting to shut down DDE Server at logoff.

Collapse -

If I had to guess, I would look at any Adobe products

by robo_dev In reply to Locally, but in circumsta ...

they tend to use DDE a lot.

I would also look closely at what is getting launched at startup. Sometimes there are applications that exist in one profile that you don't expect, like some seldom-used print utility.

Related Discussions

Related Forums