Determining from a service if a user is logged on

  • Thread starter Thread starter Marianne
  • Start date Start date
M

Marianne

After reading some posts on the subject there seemed to be a consensus that when a user is interactively logged on to a machine, that there would be a windows station called "WinSta0" that would contain a desktop called "Default". When no user was logged on then the respective windows station and desktop would not be present.

I can properly enumerate the windows station and desktops and it reports correctly when I'm logged on. However, when the service is running and I log off it still reports that there is a WinSta0 station containing a desktop called "Default". I know this because the service writes its findings to the event log every 10 seconds. So after I log off and wait a few cycles and log back on, every entry says that I'm logged on.

So, my question is how can I determine from a service is a user is logged on to a workstation? Is this the correct track to pursue or is there another way? Thanks.
 
One way is to use System.Management and query WMI's class Win32_LogonSession, this query returns all current Logon sessions and one attribute "logonype indicates the logon type, the attribute value '2' refers to an interactive logon session.
This works pretty well if there is ONLY one Interactive logon session, but no one stops a program to call "LogonUser()" and create another interactive Logon session, worse if it's called from a windows service things get a lot more complicated.

Willy.


After reading some posts on the subject there seemed to be a consensus that when a user is interactively logged on to a machine, that there would be a windows station called "WinSta0" that would contain a desktop called "Default". When no user was logged on then the respective windows station and desktop would not be present.

I can properly enumerate the windows station and desktops and it reports correctly when I'm logged on. However, when the service is running and I log off it still reports that there is a WinSta0 station containing a desktop called "Default". I know this because the service writes its findings to the event log every 10 seconds. So after I log off and wait a few cycles and log back on, every entry says that I'm logged on.

So, my question is how can I determine from a service is a user is logged on to a workstation? Is this the correct track to pursue or is there another way? Thanks.
 
Back
Top