内部员工PC定时执行应用选型咨询：Windows服务或WinForms

Hey there! Let's work through your dilemma—coming from web dev, picking the right desktop approach for your internal tool can feel overwhelming, but we can narrow it down to something user-friendly, secure, and low-hassle for your non-technical teammates.

First, let's recap your core requirements to stay aligned:

• Runs automatically twice daily (morning/evening) on employee PCs
• No visible window, just a system tray notification when it executes
• Uses Windows authentication to call TFS API and store JSON data to a database
• Avoids forcing non-technical users to manually download/install stuff

Option 1: Task Scheduler + Headless WinForms App (My Top Recommendation) #

This is the sweet spot for your use case, and here's why:

• Zero user effort: Your IT team can deploy this via Group Policy to all employee PCs in one go. No need for users to download anything or click installers.
• Lightweight & efficient: Instead of a service running 24/7, the app only launches when scheduled (morning/evening), executes its task, shows the tray notification, then exits. No unnecessary background overhead.
• Easy tray notifications: A WinForms app lets you use the NotifyIcon control to pop up a simple "Task started/completed" bubble in the system tray. Just set the main form's Visible property to false so no window ever shows up.
• Secure by design: Since the task runs under the user's Windows account, your TFS API calls and database connections can natively use Windows authentication—no hardcoded credentials needed, which is perfect for internal systems.

Quick Implementation Tips: #

1. Build the WinForms app:
   • In Program.cs, skip showing the main form and jump straight to your task logic (call TFS API, save JSON to DB).
   • Initialize a NotifyIcon with a simple icon, show a balloon tip when the task starts, then another when it finishes.
   • Make sure to clean up the NotifyIcon and exit the app once the task is done.
2. Deploy via Group Policy:
   • Place the compiled EXE in a secure internal shared folder (with read/execute permissions for all employees).
   • Use Group Policy to create a scheduled task on each PC: set triggers for your desired morning/evening times, point the action to the shared EXE, and enable the "Run only when user is logged on" option (to leverage their Windows identity for authentication).

Option 2: Windows Service (With Simplified Installation) #

If you ever need the app to run continuously (not just twice daily), a Windows Service makes sense—but for your current use case, it's overkill. That said, if you lean this way, don't use InstallUtil—it's clunky for non-technical users. Instead:

• Use the TopShelf library to wrap your service logic. It lets you build a service that runs like a console app for testing, and installs/uninstalls with simple commands like MyApp.exe install or MyApp.exe uninstall.
• Package it into an MSI installer using tools like WiX or Visual Studio Installer Projects. Users can double-click the MSI to install the service, which will run automatically in the background.
• Note: Services run under a system or service account by default—you'll need to configure it to run under the user's Windows account if you need their specific identity for TFS/database access.

Security Notes for Both Options #

• Stick with Windows authentication for TFS and your database—this avoids storing credentials in config files or code, which is far more secure for internal tools.
• Ensure the shared folder (for the EXE) or MSI installer is hosted on a trusted internal server, with proper permissions to prevent unauthorized access.

At the end of the day, the Task Scheduler + Headless WinForms App is your best bet—it's simple to deploy, user-friendly, and perfectly matches your "run twice daily, notify via tray" requirements.

内容的提问来源于stack exchange，提问作者Sandeep Thomas