Windows System Events

I’ve been trying to get the answer to this question for a while now (MS news groups, google, etc.) without success.

Is there a way to trap the following events in .NET application:
1) user locks the computer (i.e. ctrl + alt + del -> lock computer)
2) user unlocks the computer
I need my C# windows application to react when those events happen. The app will be running on Windows 2000 and possibly XP machines.

Is this possible with .NET?

Extra points available if it’s possible :)

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

It's possible, but very hard. Also you will have to use lower level code, C/C++ probably. Have a look at this discussion, it is about trapping the Ctrl + Alt + Del key combination but has very good discussions and also a link to a commercial tool that does this. Unfortunately no code is available.
You can do this through an API call on Windows 9x (95, 98, ME, etc). I don't recall the name, but if you were to google for this subject you'd probably find something.

You cannot do this API call on NT, 2000, or XP. It requires you to write a GINA.DLL (see MSDN library), which is a Win32 DLL, which you can't write in C#. You'll need C or C++ to do it.

Good luck :)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Purchasing KeyboardControlSDK (for c/c++) could help as they claims that they can catch ctrl+alt+delete. The drawback is that it uses kernel level hook which must be installed by an administator.
CompTIA Security+

Learn the essential functions of CompTIA Security+, which establishes the core knowledge required of any cybersecurity role and leads professionals into intermediate-level cybersecurity jobs.

I think you gave a wrong URL, martinv. The right one (given by me in the above mentioned thread) is:
to TheAvenger:
thank you, you are right. The bad url has  remained in my clipboard from answering another question. Thank you for correcting it.

astankovicAuthor Commented:
Thanks for your comments.

This is for an app that I'm writing on myown with no intentioins to make it available to public (yet :) ) I'm not likely to purchase third party code.

As for catching the ctrl + alt + delete, i don't think it would work in this case. Some people use ctrl + alt + delete to access the task manager, or they can do "ctrl + alt + delete" but then cancel insted of pressing "lock computer" button. And when the user unlocks the computer it doesn't neceseraly need to press ctrl + alt + delete (the unlock dialog might already be there).
I just gave "ctr + alt + delete -> lock computer" to explain what i mean by "lock computer".

I was hoping there was something like SystemEvents class which exposes events when user logs off/shuts down pc, etc.

Just an idea -- try and figure out a way to monitor api calls to user32.dll(not sure how you can do this, but I know its possible), check to see when LockWorkstation api is called. Fire your event

some magic with SetWindowsHookEx could work, but I strongly suggest to try it rather in c/c++ than c#. You are adding next level of complexity by using .NET framework for such low-level task and furthermore you'll find a lot of examples in c++ and quite few (if any) in c#.

here, I've used these WIN API before to do something ver similar.


Keyboard Hook page

You may also want to look into windows messaging since there are a number of ways to do various low level operations.

For instance...  The start button.

You can either click it with the mouse
Ctrl + esc
windows key

Locking the computer
Ctrl+alt+del click lock/press return (same thing)
windows key + L


The only way to really check for these things is to either

1) hook the windows messages and read them before they get processed
2) poll the keyboard and determine which keys are pressed

The first option is best, but also more difficult.  Option 2 is pretty basic and straight forward, but you need to play with multi-threading to get it to work properly.  You will also have to make some determination as to the interval you want to poll in, if you don't wait at all you really eat up CPU time.
Perhaps you can use a windows hook to monitor a call to user32.dll for LockWorkstation.;EN-US;Q318804

I hope this helps.

astankovicAuthor Commented:
Big thanks to everybody who commented!

You guys gave me several possibilities that I can research further.

I tired the example from msdn you provided, and it was only trapping mouse events when mouse pointer was in the applications window. That might be because you can’t have global hooks in .net. Based on that, I’, thinking that I wont be able to trap LockWorkstation message because that would require a global hook. I might be wrong there, since I never did anything with hooks.

I think your solution has the most potential. If I can figure out how to write that Win32 DLL and then use it in my .net app that would work perfectly because winlogon can inform the DLL of Lock and Unlock events…

Thanks a lot,
Instead of using gina try using notification dll that could be faster and much easier also less risky to code and use. Just see the "Winlogon Notification Packages" in MSDN. (Applies to windows 2000 and higher)

Also Please try to find out more about SystemParameterInfo function which I think could be used to get the locked and unlocked status.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.