Microsoft Knowledge Base Email Alertz

KBAlertz.com: (841927) - Explains that you should not use .NET Framework Class Libraries or other framework libraries in the core system processes.

Receive Microsoft Knowledge Base articles by E-Mail?

Every night we scan the Microsoft Knowledge Base. If technologies you're interested in are updated, we'll send you an e-mail. You only get one e-mail a day, and only when new articles are added.

Click here to create a
FREE account
Already have an account?
[Click here to Login]

Search KbAlertz

Advanced Search

Webmasters
Put kbAlertz on your website.
[ Click Here for more! ]





ASP.NET 3.5 Web Hosting with Windows 2008 and SQL 2008: Click Here!
Discount ASP.NET Hosting
ASP.NET 2.0 and 3.5
Windows2008 and SQL2008
US and UK Hosting
The ad says 3 - but KBAlertz referrals get
** SIX MONTHS FREE **


Bug Tracking Software
For bug tracking software or defect tracking software or issue tracking software, visit Axosoft.


Community Site



We Send hundreds of thousands of emails using ASP.NET Email



Expert Web Design & Graphic Design
Design44.com

ASP.NET 3.5 Web Hosting with Windows 2008 and SQL 2008: Click Here!
Discount ASP.NET Hosting
ASP.NET 2.0 and 3.5
Windows2008 and SQL2008
US and UK Hosting
The ad says 3 - but KBAlertz referrals get
** SIX MONTHS FREE **




Mentioned In








Microsoft Knowledge Base Article

This article contents is Microsoft Copyrighted material.
©2005-©2007 Microsoft Corporation. All rights reserved. Terms of Use | Trademarks




Article ID: 841927 - Last Review: March 13, 2008 - Revision: 3.3

Do not use high level languages, libraries, frameworks, virtual machines or runtimes in core operating system processes

INTRODUCTION

We recommend that you only use C languages and Win32 APIs for any add-in components that are loaded by core operating system processes. Two examples of core operating system processes are Winlogon.exe and Lsass.exe.

The behavior of any high-level language, framework, or runtime in the components that are loaded by core operating system processes is undefined. For example, the Microsoft .NET Framework and the common language runtime were not designed to run in the context of core operating system processes. The following is a partial list of high-level languages, frameworks, and runtimes where the behavior is undefined in the context of core operating system processes:
  • .NET Framework languages
    • C#
    • Visual Basic .NET
    • Managed Extensions for C++
  • common language runtime
  • Java
  • Microsoft Component Object Model (COM)
  • Microsoft COM+
  • Microsoft Distributed Component Object Model (DCOM)
  • Microsoft Foundation Classes (MFC)
  • Microsoft ActiveX Template Library (ATL) framework

MORE INFORMATION

You can plug in the following components to the Winlogon system process:
  • Graphical Identification and Authentication (Gina) DLL
  • Winlogon notification packages
You can plug in the following components to the Local Security Authority Service (LSASS) system process:
  • Password filters
  • Security Support Providers (SSPs)
  • Custom authentication packages
  • Custom subauthentication packages
  • Local Security Authority (LSA) mode Cryptographic Service Providers (CSPs), such as the Secure Channel (SChannel) CSP.

APPLIES TO
  • Microsoft Visual C++ 2008 Express Edition
  • Microsoft Visual C++ 2005 Express Edition
  • Microsoft Visual C++ .NET 2003 Standard Edition
  • Microsoft Visual C++ .NET 2002 Standard Edition
  • Microsoft Visual C# 2005 Express Edition
  • Microsoft Visual C# .NET 2003 Standard Edition
  • Microsoft Visual C# .NET 2002 Standard Edition
  • Microsoft Visual Basic 2005
  • Microsoft Visual Basic .NET 2003 Standard Edition
  • Microsoft Visual Basic .NET 2002 Standard Edition
  • Microsoft Visual J# .NET 2003 Standard Edition
  • Microsoft JScript .NET
  • Microsoft COM+ 2.0 Standard Edition
  • Microsoft .NET Framework 2.0
  • Microsoft .NET Framework 1.1
  • Microsoft .NET Framework 1.0
  • Microsoft .NET Framework Class Libraries 1.1
  • Microsoft .NET Framework Class Libraries 1.0
Keywords: 
kbsweptvs2008 kbinfo KB841927
       

Community Feedback System

Very often, it takes hours to solve a problem. Very often, you've looked high and low, and have tried a lot of solutions. When you finally found it, chances are, it was because someone else helped you. Here's your chance to give back. Use our community feedback tool to let others know what worked for you and what didn't.

Please also understand that the community feedback system is not warranted to be correct, it's simply a system that we've built to let people try and help each other. If something in a feedback response doesn't make sense to you, or you're not comfortable making changes that the feedback talks about (like registry edits), please consult a professional.

Thank you for using kbAlertz.com Feedback System.

-- Scott Cate

Anonymous User Report As Irrelevant  
Written: 7/8/2004 5:35 PM
I think it has to do with managed vs. unmanaged code, and if you are messing with with core O/S you should work in the same environment so it doesn't cross that boundary. Go with the unmanaged languages for that level of programming where you are going into an API. The Framework sits on top of the O/S and is meant to USE the lower-level features and abstract the API from developers. Use the right tool for the job and know what your tools do best, right?

Robert Swirsky - http://www.robert.to/ Report As Irrelevant  
Written: 1/24/2005 7:53 AM
This is a strange warning! While I'm a very strong C++ programmer whose been using it since the very beginning, I noew use C# whenever and whereever possible--including for Windows Services, etc.

Anonymous User Report As Irrelevant  
Written: 7/20/2005 4:46 AM
Can any body help me out by defining what is the exact need of writing a Custom Sub-Authentication package

Nitin Report As Irrelevant  
Written: 2/9/2006 7:51 AM
very interestig topic but if we get better explation with examples

Dave Bacher - http://dbdotnet.blogspot.com Report As Irrelevant  
Written: 5/11/2006 2:21 PM
The issue is pretty basic. Lets say you have COM object 1, which is bound to the .NET 1.1 framework, and COM object 2, which is bound to the .NET 2.0 framework. Now you're running in explorer.exe. If explorer.exe sees object 1 first, it instances the .NET runtime 1.1. When it loads object 2, it also gets loaded into the .NET runtime 1.1. If object 2 uses any .NET 2.0 features, it crashes and burns. If explorer sees object 2 first, then it loads the .NET runtime version 2.0. When it loads object 1, that also gets loaded in .NET runtime 2.0. If object 1 calls any deprecated call, or any call that has additional security requirements, etc. then it might fail. In any event, if either fails, bad things could potentially happen in Explorer, which could cripple the user's session. This isn't about writing services -- it is fine to write a Windows Service or Linux Daemon using .NET. It's about hooking into services such as WinLogin/GINA. GINA prompts you for your user name and password, and then goes off to verify it somehow. If you had code in this process that couldn't load, then no users could access the computer. This would be a bad thing. If you need GINA to authenticate using .NET, there is a safe solution. The safe solution is to write a C++ front end that opens a named pipe, and then have the C# back end talk to GINA over the named pipe (or any other IPC). This requires some security work to prevent interception attacks, but it prevents the problem and doesn't require much code. Alternatively, running the .NET code as an out of process (instead of an in process) server can fix the issue. Note that there are other issues also with using .NET for system processes, in that these may be loaded early in the systems boot process, when other required services are not yet available. As far as I know, .NET has no intrinsic dependencies unless you use specific frameworks (for example, you can't open an IP connection if the TCP/IP stack isn't loaded yet).

(Optional) Name

(Optional) Public URL Or Email

Comments
No HTML -- Text Only Please