{"id":8988,"date":"2020-05-16T20:22:26","date_gmt":"2020-05-17T03:22:26","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=8988"},"modified":"2025-12-10T19:17:03","modified_gmt":"2025-12-11T03:17:03","slug":"interact-with-desktop","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/interact-with-desktop\/","title":{"rendered":"Q&A: Why doesn’t “Allow service to interact with desktop” work?"},"content":{"rendered":"
\n  Our legacy Windows Service shows an alert box when it fails to print a document on our server 2012 R2 controller.<\/p>\n

I went into the service, clicked on the properties and set it to be able to interact with the desktop. How come I still can’t see the alert windows? Do I need to change something else?<\/p>\n

\"Allow<\/a><\/div>\n

— Justin F.<\/p>\n<\/div>\n

Hi Justin.<\/p>\n

Unfortunately that setting is from a bygone time. It no longer does what you expect. Let me explain.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

Old versions of Windows supported interactive services<\/h2>\n
\"Old<\/div>\n

In Windows NT, 2000, XP and Server 2003 it was reasonable (and occasionally encouraged) for a service to create windows and other graphical elements. It was possible for someone logging in to the PC to see a service’s windows, happily intermingling with conventional applications on his desktop (like Word and Excel).<\/p>\n

On those old operating systems, the “Allow service to interact with desktop” setting controlled the visibility of the service’s interface. If checked, the first person logging into the PC would see the service’s windows. If unchecked, the windows would not be visible. In short, the checkbox made sense.<\/p>\n

However, in the mid-2000s, the concept of interactive services was exposed as a security risk. Hackers developed rogue Windows Services that would invade the desktop, requesting passwords, installing dangerous software and ultimately compromising a healthy computer. Those so called shatter attacks<\/a> (because they visibly shatter the user’s secure environment) emerged as a serious threat.<\/p>\n

Fortunately the folks in Redmond were quick to respond.<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

Interactive services are crippled (or eliminated) in current editions of Windows<\/h2>\n
\"Interactive<\/div>\n

Microsoft plugged the shatter attack security hole in Windows Vista. The remedy — known as Session 0 Isolation<\/a> — is an architectural change that prevents a service’s windows from showing up on a regular desktop. Going forward, windows created by a service would be effectively hidden.<\/p>\n

The change profoundly diminished the utility of the “Allow service to interact with desktop” option. Checking the box still enables a service to show its windows, but only on the hidden Session 0 desktop<\/b>.<\/p>\n

The reality is that on or off, the checkbox cannot empower a Windows Service to show itself on your own<\/i> desktop<\/b>.<\/p>\n

But all is not lost for your situation…<\/p>\n

\n
\n
\"\"<\/a><\/div>\n<\/div>\n

However you can still see alerts from your service since you’re on Windows Server 2012<\/h2>\n

In versions of Windows where Session 0 is accessible — specifically Windows 8.1\/8 and Server 2016\/2012 — you can see the alerts from your service. You have to switch to Session 0 to see them though.<\/p>\n

To make that possible:<\/p>\n

    \n
  1. \nEnable interactive services.<\/p>\n

    Start Regedit<\/a>, navigate to HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Windows<\/span><\/b> and change the value of NoInteractiveServices<\/b> from 1 to 0:<\/p>\n

  2. \nEnable the Interactive Services Detection service<\/a>.<\/p>\n

    Launch Services<\/a>, open the Interactive Services Detection<\/b> service and change the Startup type<\/b> to Automatic<\/b> or Automatic (Delayed Start)<\/b>:<\/p>\n

    \"Enable<\/a><\/div>\n<\/li>\n<\/ol>\n

    With that in place, Windows will pop up a window whenever your service is showing an alert in Session 0:<\/p>\n

    \"Interactive<\/a><\/div>\n

    Click View the message<\/b> to switch to the austere Session 0 desktop where you should see your alert window.<\/p>\n

    And when you’re done, click Return now<\/b> to go back to the safety of your regular desktop.<\/p>\n

    \n
    \n
    \"\"<\/a><\/div>\n<\/div>\n

    Note: There is no way to see your service’s alerts on Windows Server 2019<\/h2>\n

    Unfortunately the solution for Server 2012 will not work on Server 2019 because Microsoft has completely removed access to Session 0<\/a> in their newest operating systems. There is simply no way to see an application running on the hidden desktop.<\/p>\n

    Please keep that in mind before upgrading your server!<\/p>\n