Monitoring logon-logoff events

  • Thread starter Thread starter marek zegarek
  • Start date Start date
M

marek zegarek

Hello!

1) How can I monitor events in Windows?
I need to catch login and logoff on Windows XP.

2) I will use it to build NT Service monitoring login type - by smartcard
or by password.

Maybe something by WMI? But what i must do?
 
Hi,

I am not aware of any way to do this reliably with .NET. However with some
basic C/C++ you can do it quite easily.

You need to create a dll which exports functions to handle each event you
are interested in. Then you can register the dll in the registry under the
following location

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
You can handle events like: Logon, Logoff, StartScreenSaver,
StopScreenSaver, StartShell, Startup, Shutdown, Lock, Unlock

If you want to go this route feel free to post here if you need some
assistance, I will gladly provide more detailed explanation. Also the
following link could get you going
http://msdn.microsoft.com/library/d.../creating_a_winlogon_notification_package.asp

Hope this helps
 
Thanks for an answer!
Yesterday i looked into MSGina.dll and i saw this methods.
I'm developing in vb.net, so C/C++ is teribble for me, but i must try :)
Do you know where can i find any examples how to implement any function from
winlogon notification?
 
Thanks! That is very usefull for me!

I looked in google and i cannot find any sample with
WlxGetOption
 
Hi,

For WlxGetOption you will actually have to write your own replacement GINA
dll, for many of the functions you could pass through to the original GINA
dll. This if course is a whole other excersize compared to just using the
WinLogon Notifications.
 
Back
Top