C# - window logon events

rupniceguy

Can anyone help me how to retrieve the below computer event statistics on a network, i.e. The exact time computer gets logged on, logged off, locked, unlocked, remote logged on etc, also the user name who is responsible for events.. Also this should work on windows OS(XP/Server/7). If this can be done through WMI, please let me know how... Thanks!

Dave Kreskowiak

Windows doesn't track any of this information, so no, you can't do it the way you're thinking. There are no "events" for this kind of stuff. You'd have to write a client you install on every workstation you want to track to do this. Since you're supporting Windows XP, what you do will be different than it will be for Vista/7. Most of this information you can poll from the Terminal Services API, like here[^].

A guide to posting questions on CodeProject[^]
Dave Kreskowiak

Sunil P V

This can be achieved by using Win32 API. Create a method and add a Hook to get the windows notifications including logon, logoff, locked, unlocked etc. So if you are using a Winform application include this namespace

using System.Windows.Interop;

In the initialize method add this piece:

            HwndSource source = HwndSource.FromHwnd(this.Handle);
            source.AddHook(new HwndSourceHook(WndProc));

where WndProc is

private IntPtr WndProc(IntPtr hwnd, int msg, IntPtr wParam, IntPtr lParam, ref bool handled);

Let me know if you need a detailed implementation. I can help. Also you need to add some interop methods to access the WM_WTSSESSION_CHANGE, WTS_SESSION_UNLOCK etc.

Sunil