UPDATE: If you’re a Windows user trying to figure out what’s wrong with your PC, please check out my other post: Troubleshooting Interactive Services Detection. If you are a developer (or want nerdy details), please read on.
Have seen this button flashing on the taskbar?
When you click on the button, you get this dialog.
If you click “View the message”, your screen blinks and you are taken to a blank desktop with a couple of dialog boxes.
Why is this Happening?
Services and system processes run in session 0. Prior to Vista, the console (first logged on user’s desktop) ran in session 0 as well. Vista introduced session 0 isolation to protect services from elevation of privilege exploits from the console desktop. Now, the first user’s desktop runs in session 1.
Interactive Services Detection (the blinking button on the taskbar) is a mitigation for legacy applications that detects if a service is trying to interact with the desktop. This is handled by the Interactive Services Detection (UI0Detect) service.
When you choose “View the message”, you are taken to session 0’s desktop and you can only interact with the dialog or message that services have tried to display on the desktop.
Behavior Depends on Your Bits
The Interactive Services Detection service is set to start “manually”. This means that it won’t start automatically when the system boots.
On a 32-bit version of Windows, the OS will detect desktop interaction and start the UI0Detect service and you will see the flashing taskbar button.
On a 64-bit version of Windows, if the service is a native 64-bit application, the OS will not start the UI0Detect service. Therefore, the service that is trying to interact with the desktop will appear to hang. If you need the mitigation for a 64-bit service, you will need to be sure the service is running in order to get the mitigation.
Here’s the really weird part… If you have a 32-bit service on a 64-bit Windows, WOW64 will start the UI0Detect service and you will see the mitigation. The reason for this is that the WOW64 environment will behave as close to native 32-bit as possible – including mitigations. ( Special thanks to Maarten for his assistance on figuring this out. 🙂 )
A way to play around with Interactive Services Detection is to use PsExec tool.
For example, if we try this:
| > psexec \\localhost -i 0 calc.exe |
This will launch the calculator application in session 0. This is a quick way to simulate a service interacting with the desktop. I find this example interesting. PsExec is a 32 bit application. Therefore, UI0Detect will always get started even though calc.exe is 64-bit. Here’s a snip from Process Explorer.
We can see that UI0Detect service is started in session 0 which creates a new process in session 1. The UI0Detect process in session 1 is the Interactive Service Detection dialog. PSEXESVC.exe is the PsExec command service and note that it is a 32-bit app in session 0. Calc.exe is started in session 0 because we specified session 0 as an argument to PsExec.
Fixing Multiple Issues with One Solution
If a service has this issue, it probably also has an issue with remote desktop services and/or fast user switching. Session 0 isolation, remote desktop services and fast user switching all use the same session isolation plumbing. So, if you fix this issue, you are probably fixing several issues you may have not know you had.
The Services in Windows Vista whitepaper that talks about all the changes to services including Session 0 isolation. Also, check out this classic post on Session 0 Isolation with developer guidance.
This dialog looks exactly like one I am getting on Win 7, and it is troubling because of the exact syntax of the message. The program might need information "form" you. Is this a simple programming typo, or maybe malware. In my case, I am concerned because my A/V is firing this message to upgrade it. It recently indicated a positive ID on a trojan, and am concerned it has not been effectively cleaned.
ummm …very helpful but what do i really do??keep on exiting it out?take action?if so,how?it gets annoying every seconds it pops up..how do i really get rid of this? i just bought a really small kind notebook..is that why?
Dialog and bootyliciouos,
There are two main types of applications that run on Windows (and other OS's as well). Desktop applications "interact" with the user through a user interface (windows, dialogs, etc.). Services run in the "background" and do system stuff and interact with other applications. Services should not interact with the user. Windows 7 and Vista have a boundry that isolate services from trying to interact with the user.
So, you have a service that is trying to present some kind of user interface. This is likely a service that wasn't designed for Windows 7 (probably XP). You may need a new version of the product.
To figure out what the service name is, click the "Show program details" button at the bottom of the Interactive Services Detection dialog. This will give you details about the service that is trying to interact with the desktop. Search the Internet with the service name. You should be able to find what application is having the problem based on this. If it is a legitimate application, check the company's web site for a Windows 7 version of the application.
Good luck,
Pat
I Bing'd myself here with the same issue.
As Bootylicious mentioned this is a terrific post and quite informative and all but how can I supress the dialogs?
Bob E.,
You can disable Interactive Services Detection. However, you need to remember that the misbehaving service will likely be frozen waiting for user input. This would be similar to a frozen application on the desktop – the program is stuck and isn’t working.
Please note, disabling Interactive Services Detection would be similar to putting black tape over the check engine light on your car. You’re disabling the notification but you still have a problem.
Here’s how you do it. This will disable Interactive Services Detection for all services:
1. Open the Services control panel. This can be found quickly by typing “services” in the Start menu search bar and clicking "Services" in the Programs section.
2. Find “Interactive Services Detection” in the Services list and double click it.
3. Set the Startup type to “Disabled”
The service will no longer start when you boot your computer and you will no longer see the mitigation for any service.
Pat
The little thing is STILL popping up… is there any other way of stopping it? I don't understand this at all, if you view porgram details then it comes up "C:/…" and Delete Browsing History… that's all… I can't see why it would need any kind of permissions to perform that task anyway – not that I am even trying to delete browsing history.
As someone else mentioned, could this be anything to do with a Trojan? I had one which was detected a couple of days ago and though McAffee seems to think there is nothing else there, my computer is still playing up.
Any suggestions?
Jenna,
From the information provided, it's difficult to say what program is causing the issue. In program details, you should see the path and executable name of the service that is causing the issue. It could be a service or a scheduled task that was installed on your computer at some point – possibly when your computer was compromised by the Trojan you mentioned. The interactive service detection dialog will be displayed every 5 minutes. The instructions in my previous comment will disable all interactive service detection messages after you reboot your computer. As I mentioned before, this doesn’t solve the issue, it just disables the notification.
Pat
Running W7 x64 I just got an Interactive Services Detection notice soon after startup, and it behaved as Pat said (4 Nov 2010). The message was that it was trying to close something simply called "Runtime" "in an unusual way". When I clicked on the message it disappeared and the top dialog box indicated that it was no longer trying to do anything. This was first time I saw this on my new PC. The icon had appeard in the Taskbar, but not flashing. Is anything wroing or have I been zapped? For AV etc I'm running Kaspersky 2011. I found this blog by googling "interactive services detection".
Pat,
Very informative article; thank you. I am running Windows 7 Pro 64 bit on my laptop, and Win XP Pro 32 bit on my desktop. I am trying to display a message on the 64 bit machine from the 32 bit machine (using psexec). Interactive Services Detection is halting the message until I take action. I would like to disable any holdup of the message and just have it display without any user input. Is this possible? I tried disabling Interactive Services Detection, but like you said, the psexec service just hung indefinitely and no message was ever displayed.
Pete,
It’s really hard to say what occurred. Sometimes it’s hard to figure it out unless you can debug it. My guess would be that a service crashed and the developer handled the exception by displaying a dialog box alerting you to the crash. Services can’t display dialog boxes to the interactive desktop post Vista. Therefore, the only way to see the dialog is via Interactive Services Detection. If you are up to date on your virus software, it’s unlikely a virus. If it only happened once, you probably hit an obscure bug in one of the services running on your machine.
Pat
cag8f2010
I’m not quite sure what you are trying to do. I use psexec as an example in the post because it is an easy way to demonstrate trying to launch an interactive application in session 0. In other words, I’m making a desktop application run “like” a service. The best guidance for how to interact with the desktop from a service post Vista is covered in the last section of the post under “Fixing Multiple Issues with One Solution”. The “Services in Windows Vista” whitepaper is a good place to start.
Pat
My sister has this issue on her laptop. It started today. Among the problems noted so far, Windows File Search routine has been hidden. The anti-virus/Firewall has been disabled and can't be re-started. The Control panel is not responding and any attempt to open any browser asks if the browser exe file should be opened with adobe reader or yahoo messenger. You do not open an exe file with either of these programs.
When you read the message it gives an indication of an im worm attack of some kind. If you leave the message open long enough it reboots automatically. This would appear to be some kind of trojan horse/take over virus.
I resolved the whole uidetect.exe the easy way – i hope. Rebooted to safe mode without networking.
Anti-virus/firewall off. System restore to an earlier date. The problem went away.
Does anyone know how to adjust the timeout when you *do* go to the UIO session? We use it to set configuration in our application, but it times out when idle for about a minute, kicking us out of RDP sessions and all kinds of problematic behavour.
Thanks!
Patrick,
As far as I know, you can't configure the timeout. Interactive services detection is a mitigation for services interacting with the desktop which has been deprecated for a while. You should move away from using it to configure your application. If you want to create a UI from a service, you should use CreateProcessAsUser to create a process in the user’s interactive session. Take a look at the Services for Windows Vista whitepaper I mentioned at the end of the post.
Pat
Thanks for the quick reply. Unfortunately, it isn't our software, but we are a high-level dealer/distributor building upon their software for <deleted>. Our software has a command-level interface that runs in the user environment to interact with the service, so we're fine though we didn't know about this when we did the design, that's just the way we build these products.
We run their software as a service because it has to start up when the system starts and not be dependent on a user logging in and relying on a user not stopping the software etc. Their software works fine run as a service using FireDaemon to configure the service, but we need to remotely manage / configure the software and being kicked out of a remote connection that takes 5-10 minutes to set-up after a minute of inactivity just isn't going to work. Running a local copy as a non-service requires shutting down the service plus extra licensing and configuration within the application, so that's not really an option either.
Ah well, more challenges! The boss joked about hiring summer students to wiggle the mouse when we aren't actively doing something in the session to keep it alive <lol>.
Patrick,
I understand your situation and it is unfortunate since you don't own the code. The interactive services detection mitigation is designed to limit the exposure of an "application" running in session 0. I don't know of a configuration to change the inactivity timeout. You will need to have some UI interaction occuring (keyboard or mouse) to avoid timing out.
Pat
Is it possible to run a service to interact with the desktop and have it open in Windows 2008 Server Standard Edition?
Jason,
Session 0 isolation exists in Windows Server 2008. So, you can't interact with the desktop. Windows Server 2008 is the server version of Vista. Windows Server 2008 R2 is the server version of Windows 7.
Pat
I'm receiving ISD's on my 2008R2 (64bit) Terminal Servers that when opened are print device configuration dialog boxes. Any clue how to rid my users of these prompts? I have determined that the ISD's are all pertaining to 2 certain printers (drivers).
hi there,
I have the same problem as described above except that the popup remains less than a second. Therefore I have no chance to get to know which service is causing the problem. Is there any way to get the popup to stay or to identify the problematic service another way?
thanks in advance
Eric,
Ideally, you could look for updated software for these printers that don't do this. Your other option would be to disable interactive services detection. However, this may cause the service to appear to hang if the configuration dialog is modal. See my post on troubleshooting Interactive Services Detection for information on disabling the notification. blogs.msdn.com/…/troubleshooting-interactive-services-detection.aspx
Pat
Matrix,
Take a look at my troubleshooting post: blogs.msdn.com/…/troubleshooting-interactive-services-detection.aspx.
You could also look for events in your Application log in event viewer. The misbehaving service may log an event.
Pat
There is a typo in this dialog box. It says "might need information form you". That should be "…from you". I'm seeing this on an up to date Windows Server 2008 installation.
I had the same problem… found out it was an OLD HP laser printer I have connected to my W7 machine. Put paper in it and it went away.
Thanks for this article. We are having a problem with our application calling an executable which is not designed with this user/system boundary in mind. Our application is running as a service and calling out to Windows (Server 2008) to run a command line version of a third party executable. Mostly this just functions in the background as it should but when occasionally its target file is missing it tries to pop a dialog on the "user" desktop. Even on an earlier version of Windows, there would still be no user there to click on it, as it is a browser delivered application. This causes a big problem as the calling process hangs waiting for the command line program to terminate, so it hangs around taking up some RAM and a user licence!
The program in question does not seem to have a switch to suppress notifications, or log them to a file or anything useful.
It would not be a solution to disable the ISD service, the program would still freeze waiting for input. I don't suppose there is a way to force the dialog to be "OKed", preferably for this application? Or to intercept the dialog somehow and suppress it.
Of course the real solution would be to dump the program in question and use a better product, as it is to put it bluntly, ***. We are unfortunately stuck with it in the short term.
Adam,
Session 0 isolation is intended to prevent interaction from the user's session with the "console" session 0. This is to prevent "shatter attacks" en.wikipedia.org/…/Shatter_attack. A potential workaround would only work if it also runs in session 0. I'm hesitant to suggest a solution but if you're savvy enough, you might be able to use a scheduled task run your workaround in session 0 to dismiss the dialog.
Pat
I've read all the comments and the article and still am baffelled as well.
My 'faulting' service when I click Show Program Details shows up as:
Message Title: Server Setup
Program Path: C:WindowsSYSTEM32ntdll.dll
Received: Monday February 18, 2013 10:48:45 AM
It just won't stay away, and so far as I know ntdll.dll is an OS Kernel level system file, yes?
Hi Pat,
Thanks for the informative article. I have another question. The application service that interacts with desktop runs command prompt scripts (BAT scripts) without needing user input/interaction. So, in order to not see the dialog (from interactive services detection), would it be possible to disable this service (let's call it ISD) just for this particular application service? I don't want to disable ISD service totally (as I want to can catch other misbehaving services). Could you please let me know.
Thanks
This error box with the above title is constantly popping up on my screen. When I click for it to show me the message it pops up with a message. "The Application Data folder for Visual Studio could not be created." I have not been able to pinpoint the problem and neither has my instructors. Please help me figure out what is causing this because having it pop up every minute. I appreciate all the help you can give. I came by your answers that disabling the services can't resolve the problem. Could you please guide me to resolve the issue. BTW I'm using windows 7 Professional
Thanks.
i have been using antivirus and i scanned computer everyweek but some difficulties with my pc and i think it is a virus but my antivirus cant detect it and it say it is a interactive service detection, the location of the program is in c:syswow64fsusbexservice.exe
what i want to know is : is that really a virus or just some program and how to dangerous the program for my computer
sry for my bad language and thx before
OK, I'm really not buying into the malware thingy… I didn't have this damn thing pop up until I had issues with a MICROSOFT update which I had to uninstall in order to get my computer functioning at all. Now I have this Interactive Services Detection crap and it seems it came from MICROSOFT. Can you please speak plain English for those of us who are not programmers and direct us on how to fix it in a way we can understand, or have MICROSOFT download a fix since it seems to have come from them. I don't really want to just turn it off. I use my computer for work, and I need it to be communicating with every program at all times. It is running very slow compared to before the microsoft update and these issues. Thank you for your help. I really appreciate it.
By the way, the last time I had to toss out a computer and buy this one was the result of a Microsoft "update" that prevented me from saving a document once I entered a citation. I was using the computer for school and put many hours into my documents including math problems which were very cumbersome. To lose even part of one of those docs was eye-gouging to say the least. We uninstalled Word and tried some other things. Even after my husband wiped the hard drive and re-installed everything, Word still would not save a doc once citations were used. I am pretty frustrated with the Microsoft monopoly at this point.
@Pat Altimore MSFT , thank you s much for the information 🙂
i have also these problem did you all help me
Tnx Pat A….so far works well…no more bothersome service messages…
dat rotding maakt me stapelgek iritante verschijning kan hem nergens vinden
ook niet in mn confuratiescherm
ik heb daar niet om gevraagd maar nesteld zich gewoon op mn pc
ik wil er van af en weet niet hoe
gr alicia
Pat.
is that vairus or what ? i disabled it but i don't understand what is this ?
OK, I know next to nothing about computers. So is this a bad thing to have start popping up on my screen? Should I run Norton?
I have problem with UIO when I start Bluestacks. I have Windows 7 x64 Ultimate a UIO pops up when Bluestacks is loading. Can you help me? Thx.
Thanks Pats,
By doing that interactive service detection stop and disable it works fine now. I was trying everything since last 4-5 hours, I have done reinstalling all software and checking firewall as well but couldn't figure it what was happening, After reading your article and disabling the service gives a pleasure to work peacefully. I thought some one hacked my system and monitored my internet activity as it flashes every few seconds. Thanks a lot for the help.
– Gyan
I can't make head or tail of this article
Its actually easy to understand. Maybe learn how to use a computer first? By the way guys, there are no hackings or viruses present in this situation. Its simply normal windows functionality at hand.
I started getting this flashing "interactive services" box and no specific info. I have Win7. Finally I pulled up my printer devices/printers screen and saw that I had an otherwise unknown printer displayed. I deleted it and vol-aw no more interactive services display.
As I think back I had a problem getting my wireless HP printer to scan and send an image to my desk top and so I hard cabled the two momentarily and that activity must have established the other printer identity. And since I didn't download a driver probably created the confused situation or near as I can deduce.
Thanks Pat. It sort of helped me too!
The syntax of the message bothers me as well. "might need information form you"
Just got my first Interactive services detection alert. Never seen it before… running windows 7, 32bit. So I ended up looking at "view my message" also I have the same text as an earlier blog comment "the program might need information FORM you or your permission to complete a task." Didn't notice the spelling error. Looked at the program details…
program path is
44ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2COMCTL32.dll
clicked view message…. screen flickered and switched to a blank screen (light grey) and a windows classic dialog box that said "return to desktop"
got a weirded out and hit crtl, alt, delete and went to the task manager and got back to my normal looking desk top.. Ran malwarebytes (no results), ran avast quick scan (no results)
Is this normal or what…?
Just had the same issue, no idea why, no virus/malware detected
Yes, just received a notification myself, on Windows 7/32 Ultimate freshly rebuilt. Many, many patches have been installed.
From the explanation, we can deduce that the problem is a service which runs in session 0. Our user desktop is in session 1. The message is telling us that something is trying to interact with us in session 0 but has no way to display in session1. Clicking on view message takes us to session 0, but even on that desktop the service cannot display.
Summing it up, there is a device driver that is not compatible with Windows 7 (Vista, 2008, 2008 R2, maybe later versions of Windows) that is causing the problem. Searching the application log may turn up a hint. Searching the registry may show more.
There are actually TWO typographical errors in the message. The one everyone noticed ("FORM" instead of "FROM") is also in the screenshot in this article. The other one appears when you show details. It says "DEVICES(S)" instead of "DEVICE(S)."
My sister sent me a screenshot of this (coming from C:windowsSystem32spoolsv.exe). I kinda understood what was going on and told her it was OK. Right after telling her that, I had to second-guess myself because I saw 2 typos in the same dialog and I wondered if it was really a legit message / dialog from Windows.
Did Microsoft ever fix the typos with Windows 10?
I find it interesting in all of the research I have done on this, not one comment from someone in the know about the typos, is reading comprehension that bad, are people too stupid to realize the actual concern is getting a message with a typo is usually indicative of it being possibly malicious? It is 2016 and this was opened 6 years ago and just had this message, yet not one confirmation that the TYPO is nothing to worry about.
I’m running Windows 7 on 32 bit and Just got this Services Detection message today after an automatic update from Microsoft. I remote to corporate using VPN and don’t know yet what to make of it. I did, however notice immediately the typo, and wondered about possible virus. I will be checking with my IT department.
> psexec \\localhost -i 0 calc.exe
> psexec \\localhost -i 0 calc.exe
Total gobbledygook – you’ve lost me with the jargon that makes you feel superior to non-computer nerds, Goodbye – I’m no wiser.
Hi Dave,
This post was targeted toward developers who write services. If you are just trying to troubleshoot what is causing the issue, check out my other post here: https://blogs.msdn.microsoft.com/patricka/2011/03/14/troubleshooting-interactive-services-detection/
Pat
Google is your friend. If you stumble across a development blog, don’t assume it’s written for average users. But hey – that’s just me thinking out loud.
I’m developing a service that uses a trial component (you need to click OK to make the component work). If i click “View the Message” on Interactive Service Detection I enter Session0 but all input device are disabled: I can’t click anything so I have to wait timeout to go back to user desktop session.
Any idea about why this happens? I’m running Windows10 (more info: http://superuser.com/questions/1111441/unable-to-interact-with-a-dialog-on-secure-desktop)
Hi aDone,
You should use WTSSendMessage for a simple dialog. https://msdn.microsoft.com/en-us/library/aa383842(v=vs.85).aspx. Basically, you need to use a Windows Terminal Services API to display the dialog in another session. Take a look at the guidance documents at the end of the post.
Pat
I have an Interactive Services Detection always popping up, I am too scared to “View The Message” because I pressed it with confidence and my screen blacked out, I panicked and took out the charger from the laptop, I really need help, I am scared it may be a virus or something, but I don’t want to risk anything, the window is kinda like this:
A program running on this computer is trying to display a message.
The program might need information form you or your permission to complete a task.
Why does this happen?
-> View the message
-> Ask me later
^ Hide program details
Program(s) or devices(s) rquesting attention.
Message title: RunDLL
Program path: C:\Windows\System32\rundll32.exe
Received: Today, March 05, 2017, 5 minutes ago (Well actually I received it at around 12:30 AM when I reopened the laptop)
This problem occurs when a program is not fully compatible with Windows.
Please contact the program or device manufacturer(s) for more information.
Hi Damian,
When you view the message, your screen will flash. Windows is switching between sessions (from session 1 to session 0) and that’s what’s causing the screen to go black. Interactive services detection is a compatibility mitigation. It’s not the best user experience. If you want to try to figure out what might be causing the problem, try some of the techniques in my other post Troubleshooting Interactive Services Detection.
Pat
Sir, I get this when I log into my work desk top. Does this mean they are taking snapshots of my desk top?
Hi Kim,
No, it doesn’t take any snapshots of your desktop.
Pat
Hello
I am having same issue when I deploy Litetouch.vbs , the main deployment file from MDT, to a machine.
I don’t see this issue if I run the litetouch.vbs from the same computer.
what seems to be the issue and is there any solution for this?
Hi Sid,
My guess would be that the deployment tool is launching the script from a service. Services run in session 0. The other scenario you are probably launching from the desktop (session 1). Maybe try running the script from a login script?
Pat