Solved

Winlogon Notification Packages

Posted on 2002-07-25
12
964 Views
Last Modified: 2008-02-01
I have a little program running as a w2k service, and I need to add the code so that it gets called when a user logsOn and logsOff.

I was thinking with the Winlogon Notification Packages. Has anybody worked with this package ?

Thanks,
Carlos
0
Comment
Question by:cvillegas
  • 5
  • 4
  • 3
12 Comments
 
LVL 86

Expert Comment

by:jkr
ID: 7178269
This IMHO is overkill for what you want to do - it'd be way easier to use a 'RegNotifyChangeKeyValue()' on 'HKEY_USERS'. This will notify your service when a user's registry hive is loaded or unloaded, indicating a logon or logoff.
0
 

Author Comment

by:cvillegas
ID: 7178291
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
 

Author Comment

by:cvillegas
ID: 7178308
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
 
LVL 86

Expert Comment

by:jkr
ID: 7178313
>>Concern: what would happen if a user removed/changed/added information in the hive

That's something that I had in mind too. Basically the trick is to not watch the whole subtree, but only HKEY_USERS, like e.g.

while ( true) {

 if ( ERROR_SUCCESS == RegNotifyChangeKeyValue ( HKEY_USERS, FALSE, REG_NOTIFY_CHANGE_NAME, NULL, FALSE)) {

   // user logged on or off
 }
}

0
 

Author Comment

by:cvillegas
ID: 7178324
jkr:
Tell me a little more about your solution. Concern: what would happen if a user removed/changed/added information in the hive.

However, i'm open to suggestions. Please tell me a little more specific so that perhaps I can prototype it.

Thank you.
Carlos
0
 
LVL 86

Expert Comment

by:jkr
ID: 7178336
As you seem to be using IE, do *not* refresh this page, it'll just add the same comment on and on - use the 'reload' link at the top instead...
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:cvillegas
ID: 7178351
jkr: suppose we have a scenario that two users log into a box. Correct me if I'm wrong, but wouldn't I have to keep track of two lists of users (one before the notify and one after the notify) that to determine which ones logged on/off?

Tell me something, can I, as a mischevious admin, remove entires from the HKEY_USERS?
0
 
LVL 86

Expert Comment

by:jkr
ID: 7178379
>>Correct me if I'm wrong, but wouldn't I have to keep
>>track of two lists of users (one before the notify and
>>one after the notify) that to determine which ones
>>logged on/off?

Actually, it's sufficiand to read the key names, as they are in fact the textual representation of a SID - you can simply call 'LookupAccountSid()' to get the clear text names.

>>Tell me something, can I, as a mischevious admin, remove
>>entires from the HKEY_USERS?

Theorhetically yes - but not by default, as the security there is set to "SYSTEM". You'd have to take ownership first.
0
 
LVL 22

Accepted Solution

by:
ambience earned 500 total points
ID: 7179302
cvillegas , IMHO there is not much an overkill in writing a notification package, it appears that writing a package is a very simple practice.

All you need to do is write a dll that exports functions that Winlogon should call when required for e.g.

void OnLogon (PWLX_NOTIFICATION_INFO pInfo)
{
     ....
}

void OnLogoff (PWLX_NOTIFICATION_INFO pInfo)
{
     ....
}

build that dll and register it under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

DllName = <your dll>
Logon = "OnLogon"
Logoff = "OnLogoff"

and thats all. There are about seven more events that you can hook, and the best thing is that you only need to handle what you require nothing more nothing less.

Though the registry approach may work but i recommend going through the proper channel. Also that is somewhat constrained a little bit for e.g. how about if you also want to handle "Shutdown"  or "Lock" event sometime.
0
 

Author Comment

by:cvillegas
ID: 7180960
ambience: does the DLL need to registerDLL/unregisterDLL methods. It's not a COM component so It doesn't get registered right?
0
 
LVL 22

Expert Comment

by:ambience
ID: 7184329
yes it doesnt, it has to be in system directory so that the entry DllName can contain the name of your file, or DllName can contain the path to the dll (though i havent tried this one, but i think it will work).
0
 
LVL 22

Expert Comment

by:ambience
ID: 7184337
in a sense methods do get registered , but that is by means of entries under specific registry keys.

As shown in my previous posts.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Introduction This article is the first in a series of articles about the C/C++ Visual Studio Express debugger.  It provides a quick start guide in using the debugger. Part 2 focuses on additional topics in breakpoints.  Lastly, Part 3 focuses on th…
  Included as part of the C++ Standard Template Library (STL) is a collection of generic containers. Each of these containers serves a different purpose and has different pros and cons. It is often difficult to decide which container to use and …
The goal of the tutorial is to teach the user how to use functions in C++. The video will cover how to define functions, how to call functions and how to create functions prototypes. Microsoft Visual C++ 2010 Express will be used as a text editor an…
The viewer will be introduced to the technique of using vectors in C++. The video will cover how to define a vector, store values in the vector and retrieve data from the values stored in the vector.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now