Solved

Detecting Windows Logon events in XP/Vista

Posted on 2008-10-20
8
2,733 Views
Last Modified: 2013-12-04
I'me developing and application where I need to detect logons and then display something when somebody has actually logged on. Note that the customer has specified 'logon' as any time a user goes through a signon screen (thus a workstation unlock counts as a logon here).

This is going to be used in Vista in the future, so Winlogon Notification Packages seem to be out, as does the GINA approach.

My readings imply that I have two ways to go:
- Service Control Manager Notifications (which seem to provide lock/unlock/logoff/logon states)
- the System Events Notification Service (which provides ISensLogon methods for the four above, plus others such as StartShell and StopScreenSaver).

Has anybody used or played with the above, and can they give comments on which is the best way to go? Note that the application will have to be able to look across different logons, so I suspect it will end up as a service. On the other hand, I'm still at the thinking stage so nothing's cast in stone.

Any and all comments welcome!                                    

John B
0
Comment
Question by:prunesquallor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 22761126
Longshot here but what about turning on security logging for successful events. This would create an event in the event viewer for each successful logon/authentication.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761291
No need to use a GINA here, take a look at "Winlogon Notification Packages": http://msdn.microsoft.com/en-us/library/aa380545.aspx

The pages linked from there will give you detailed information on how to handle the events described at http://msdn.microsoft.com/en-us/library/aa380544(VS.85).aspx ("Winlogon Notification Events")

On Vista, these are superseded by the System Event Notification Service (SENS) - see http://msdn.microsoft.com/en-us/library/aa376860.aspx ("ISensLogon Interface") for more on that.
0
 

Author Comment

by:prunesquallor
ID: 22761368
Thanks for t comments. My immediate responses are:
 - Is it easy to programmatically read the event log (especially in real time - the program has to respond to the logon event)?
- I believe the Winlogon Notification Packages won't work under Vista (nor will GINAs), which alas puts them out of play.
- What I was looking for was if anyone had tried SENS vs Service Control Manager Notifications, and could recommedn either approach. Or is SENS the 'official' way to go?

ATB and thanks,

John B
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 86

Accepted Solution

by:
jkr earned 500 total points
ID: 22761397
'SENS' is the official way for Vista, as the 'Winlogon Notification Packages' are for XP et. al. - both are not really hard to implement at all, you are just using a callback interface for SENS and a callback function for XP.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761403
BTW, reading the Event Log would mean "polling", which is something you usually want to really avoid.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 22761521
I have done something similar in the past. Adding the lines bellow to the logon script of all users you wish to affect will create a text log file of the user name, computer to which they have logged on, date and time, and the IP from which they have connected. Then the second part sends a pop up message to "ComputerName" that "UserName" has logged in. In order for this the windows messaging service needs to be enabled. Please advise if you need more details.

:Logging
If Exist "\\ServerName\Logs\LogOns.Log" GoTo START
Echo Log File > "\\ServerName\Logs\LogOns.Log"
:START
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,12%  %Time:~0,5% >> "\\ServerName\Logs\LogOns.Log"
Netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\ServerName\Logs\LogOns.Log"

:NOTIFY
Net Send ComputerName %username% logging on
:END

0
 

Author Closing Comment

by:prunesquallor
ID: 31507944
Thanks!
0
 

Author Comment

by:prunesquallor
ID: 22770185
Thanks, all. Looks like I'll be reading the SENS stuff. Sorry for the delay in getting back (dead machine).

JB
0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction: Ownerdraw of the grid button.  A singleton class implentation and usage. Continuing from the fifth article about sudoku.   Open the project in visual studio. Go to the class view – CGridButton should be visible as a class.  R…
In this post we will learn different types of Android Layout and some basics of an Android App.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question