Solved

Detecting Windows Logon events in XP/Vista

Posted on 2008-10-20
8
2,703 Views
Last Modified: 2013-12-04
I'me developing and application where I need to detect logons and then display something when somebody has actually logged on. Note that the customer has specified 'logon' as any time a user goes through a signon screen (thus a workstation unlock counts as a logon here).

This is going to be used in Vista in the future, so Winlogon Notification Packages seem to be out, as does the GINA approach.

My readings imply that I have two ways to go:
- Service Control Manager Notifications (which seem to provide lock/unlock/logoff/logon states)
- the System Events Notification Service (which provides ISensLogon methods for the four above, plus others such as StartShell and StopScreenSaver).

Has anybody used or played with the above, and can they give comments on which is the best way to go? Note that the application will have to be able to look across different logons, so I suspect it will end up as a service. On the other hand, I'm still at the thinking stage so nothing's cast in stone.

Any and all comments welcome!                                    

John B
0
Comment
Question by:prunesquallor
8 Comments
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 22761126
Longshot here but what about turning on security logging for successful events. This would create an event in the event viewer for each successful logon/authentication.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761291
No need to use a GINA here, take a look at "Winlogon Notification Packages": http://msdn.microsoft.com/en-us/library/aa380545.aspx

The pages linked from there will give you detailed information on how to handle the events described at http://msdn.microsoft.com/en-us/library/aa380544(VS.85).aspx ("Winlogon Notification Events")

On Vista, these are superseded by the System Event Notification Service (SENS) - see http://msdn.microsoft.com/en-us/library/aa376860.aspx ("ISensLogon Interface") for more on that.
0
 

Author Comment

by:prunesquallor
ID: 22761368
Thanks for t comments. My immediate responses are:
 - Is it easy to programmatically read the event log (especially in real time - the program has to respond to the logon event)?
- I believe the Winlogon Notification Packages won't work under Vista (nor will GINAs), which alas puts them out of play.
- What I was looking for was if anyone had tried SENS vs Service Control Manager Notifications, and could recommedn either approach. Or is SENS the 'official' way to go?

ATB and thanks,

John B
0
 
LVL 86

Accepted Solution

by:
jkr earned 500 total points
ID: 22761397
'SENS' is the official way for Vista, as the 'Winlogon Notification Packages' are for XP et. al. - both are not really hard to implement at all, you are just using a callback interface for SENS and a callback function for XP.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 86

Expert Comment

by:jkr
ID: 22761403
BTW, reading the Event Log would mean "polling", which is something you usually want to really avoid.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 22761521
I have done something similar in the past. Adding the lines bellow to the logon script of all users you wish to affect will create a text log file of the user name, computer to which they have logged on, date and time, and the IP from which they have connected. Then the second part sends a pop up message to "ComputerName" that "UserName" has logged in. In order for this the windows messaging service needs to be enabled. Please advise if you need more details.

:Logging
If Exist "\\ServerName\Logs\LogOns.Log" GoTo START
Echo Log File > "\\ServerName\Logs\LogOns.Log"
:START
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,12%  %Time:~0,5% >> "\\ServerName\Logs\LogOns.Log"
Netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\ServerName\Logs\LogOns.Log"

:NOTIFY
Net Send ComputerName %username% logging on
:END

0
 

Author Closing Comment

by:prunesquallor
ID: 31507944
Thanks!
0
 

Author Comment

by:prunesquallor
ID: 22770185
Thanks, all. Looks like I'll be reading the SENS stuff. Sorry for the delay in getting back (dead machine).

JB
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
sameEnds challenge 3 135
Change to event 1 103
Question to Pivot table 1 36
Windows Mail question 15 47
Introduction: Dialogs (1) modal - maintaining the database. Continuing from the ninth article about sudoku.   You might have heard of modal and modeless dialogs.  Here with this Sudoku application will we use one of each type: a modal dialog …
For a while now I'v been searching for a circular progress control, much like the one you get when first starting your Silverlight application. I found a couple that were written in WPF and there were a few written in Silverlight, but all appeared o…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now