When did user logon

[RickZ]

I have a program that runs as a service and needs to know when any user has successfully logged in. Using the SystemInformation.UserName shows that 'this' process was stated by the 'SYSTEM'. I have been forewarned about touching the security events by the end users IT management, so looking for a valid logon event with the current setting are out of the question. Any ideas would be very much appreciated. Rick

[Heath Stewart]

A service always runs as the user under which it's configured to run. If your service is configured to run as SYSTEM, then it will always run as SYSTEM when the service is started (at startup if configured as such, which is the default behavior). Many services will implement APIs that impersonate users but still can only run as a certain account (like SYSTEM). If you want to moniter when other users log in (since your service is continually running despites whether or not someone's logged in), then you need to monitor system events. The .NET FCL (Framework Class Library) exposes no such APIs, so you'll have to use unmanaged code through COM interop or P/Invoke. If you're limited from checking security events, then you could use WMI and handle an event query for the Win32_LogonSession WMI class. The details are buried in Microsoft implementations and all you have to do is register to receive an event when something changes. See the class documentation for the System.Management namespace and see MSDN Magazine[^] for several good articles (including links to more information and a good WMI plugin for VS.NET's Server Explorer (beta for 2002, released for 2003 - but both work good).

Microsoft MVP, Visual C# My Articles