?
Solved

Winlogon Notification Packages

Posted on 2002-07-25
12
Medium Priority
?
980 Views
Last Modified: 2008-02-01
I have a little program running as a w2k service, and I need to add the code so that it gets called when a user logsOn and logsOff.

I was thinking with the Winlogon Notification Packages. Has anybody worked with this package ?

Thanks,
Carlos
0
Comment
Question by:cvillegas
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
12 Comments
 
LVL 86

Expert Comment

by:jkr
ID: 7178269
This IMHO is overkill for what you want to do - it'd be way easier to use a 'RegNotifyChangeKeyValue()' on 'HKEY_USERS'. This will notify your service when a user's registry hive is loaded or unloaded, indicating a logon or logoff.
0
 

Author Comment

by:cvillegas
ID: 7178291
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
 

Author Comment

by:cvillegas
ID: 7178308
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 86

Expert Comment

by:jkr
ID: 7178313
>>Concern: what would happen if a user removed/changed/added information in the hive

That's something that I had in mind too. Basically the trick is to not watch the whole subtree, but only HKEY_USERS, like e.g.

while ( true) {

 if ( ERROR_SUCCESS == RegNotifyChangeKeyValue ( HKEY_USERS, FALSE, REG_NOTIFY_CHANGE_NAME, NULL, FALSE)) {

   // user logged on or off
 }
}

0
 

Author Comment

by:cvillegas
ID: 7178324
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
 
LVL 86

Expert Comment

by:jkr
ID: 7178336
As you seem to be using IE, do *not* refresh this page, it'll just add the same comment on and on - use the 'reload' link at the top instead...
0
 

Author Comment

by:cvillegas
ID: 7178351
jkr: suppose we have a scenario that two users log into a box. Correct me if I'm wrong, but wouldn't I have to keep track of two lists of users (one before the notify and one after the notify) that to determine which ones logged on/off?

Tell me something, can I, as a mischevious admin, remove entires from the HKEY_USERS?
0
 
LVL 86

Expert Comment

by:jkr
ID: 7178379
>>Correct me if I'm wrong, but wouldn't I have to keep
>>track of two lists of users (one before the notify and
>>one after the notify) that to determine which ones
>>logged on/off?

Actually, it's sufficiand to read the key names, as they are in fact the textual representation of a SID - you can simply call 'LookupAccountSid()' to get the clear text names.

>>Tell me something, can I, as a mischevious admin, remove
>>entires from the HKEY_USERS?

Theorhetically yes - but not by default, as the security there is set to "SYSTEM". You'd have to take ownership first.
0
 
LVL 22

Accepted Solution

by:
ambience earned 2000 total points
ID: 7179302
cvillegas , IMHO there is not much an overkill in writing a notification package, it appears that writing a package is a very simple practice.

All you need to do is write a dll that exports functions that Winlogon should call when required for e.g.

void OnLogon (PWLX_NOTIFICATION_INFO pInfo)
{
     ....
}

void OnLogoff (PWLX_NOTIFICATION_INFO pInfo)
{
     ....
}

build that dll and register it under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

DllName = <your dll>
Logon = "OnLogon"
Logoff = "OnLogoff"

and thats all. There are about seven more events that you can hook, and the best thing is that you only need to handle what you require nothing more nothing less.

Though the registry approach may work but i recommend going through the proper channel. Also that is somewhat constrained a little bit for e.g. how about if you also want to handle "Shutdown"  or "Lock" event sometime.
0
 

Author Comment

by:cvillegas
ID: 7180960
ambience: does the DLL need to registerDLL/unregisterDLL methods. It's not a COM component so It doesn't get registered right?
0
 
LVL 22

Expert Comment

by:ambience
ID: 7184329
yes it doesnt, it has to be in system directory so that the entry DllName can contain the name of your file, or DllName can contain the path to the dll (though i havent tried this one, but i think it will work).
0
 
LVL 22

Expert Comment

by:ambience
ID: 7184337
in a sense methods do get registered , but that is by means of entries under specific registry keys.

As shown in my previous posts.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Templates For Beginners Or How To Encourage The Compiler To Work For You Introduction This tutorial is targeted at the reader who is, perhaps, familiar with the basics of C++ but would prefer a little slower introduction to the more ad…
Basic understanding on "OO- Object Orientation" is needed for designing a logical solution to solve a problem. Basic OOAD is a prerequisite for a coder to ensure that they follow the basic design of OO. This would help developers to understand the b…
The viewer will learn how to clear a vector as well as how to detect empty vectors in C++.
The viewer will be introduced to the member functions push_back and pop_back of the vector class. The video will teach the difference between the two as well as how to use each one along with its functionality.
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question