Joe White is right, but there is a workaround to this problem, you can create a remote thread in a process created in a user session (session 1 or so) using the CreateRemoteThread function, and there are two ways for you: for this:
1- An easy way is to create a separate DLL and place the screen capture code into it, and then use CreateRemoteThread to load the DLL into the user process (DLL Injection), let it say (explorer.exe). Here is an example DLL Injection:
var PID: Cardinal; DLL_Name: string; pDLL: Pointer; hProcess, BW: Cardinal ; hRemote_Thread: Cardinal; begin DLL_Name := 'C:\ScreenCap.dll'; PID := 3052; // (explorer.exe process ID) hProcess := OpenProcess(PROCESS_ALL_ACCESS, false, PID); pDLL := VirtualAllocEx(hProcess, 0, Length(DLL_Name), MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(hProcess, pDLL, PChar(DLL_Name), Length(DLL_Name), BW); CreateRemoteThread(hProcess, nil, 0, GetProcAddress(GetModuleHandle('kernel32.dll'), 'LoadLibraryA'), pDLL, 0, hRemote_Thread); CloseHandle(hProzess); end;
This is for the non-Unicode version of Delphi (<2009), for unicode you should multiply the length of the DLL_Name by the size of Char (Length (DLL_Name) * SizeOf (Char)) in both VirtualAllocEx and WriteProcessMemory, and you can use LoadLibraryW instead.
When your service starts, it enters the DLL and starts writing, I suggest that you add code to the DLL that checks your service status, behave accordingly, you can use several threads, but be careful, you should not create threads in DLLMain, since it can cause a dead end.
2- The difficult way, you can enter all the code without creating a separate DLL, you can check this article, which covers all this, in C ++, but it is very useful and not so difficult to understand:
http://www.codeproject.com/KB/threads/winspy.aspx