?
Solved

Detecting Windows Logon events in XP/Vista

Posted on 2008-10-20
8
Medium Priority
?
2,740 Views
Last Modified: 2013-12-04
I'me developing and application where I need to detect logons and then display something when somebody has actually logged on. Note that the customer has specified 'logon' as any time a user goes through a signon screen (thus a workstation unlock counts as a logon here).

This is going to be used in Vista in the future, so Winlogon Notification Packages seem to be out, as does the GINA approach.

My readings imply that I have two ways to go:
- Service Control Manager Notifications (which seem to provide lock/unlock/logoff/logon states)
- the System Events Notification Service (which provides ISensLogon methods for the four above, plus others such as StartShell and StopScreenSaver).

Has anybody used or played with the above, and can they give comments on which is the best way to go? Note that the application will have to be able to look across different logons, so I suspect it will end up as a service. On the other hand, I'm still at the thinking stage so nothing's cast in stone.

Any and all comments welcome!                                    

John B
0
Comment
Question by:prunesquallor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 22761126
Longshot here but what about turning on security logging for successful events. This would create an event in the event viewer for each successful logon/authentication.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761291
No need to use a GINA here, take a look at "Winlogon Notification Packages": http://msdn.microsoft.com/en-us/library/aa380545.aspx

The pages linked from there will give you detailed information on how to handle the events described at http://msdn.microsoft.com/en-us/library/aa380544(VS.85).aspx ("Winlogon Notification Events")

On Vista, these are superseded by the System Event Notification Service (SENS) - see http://msdn.microsoft.com/en-us/library/aa376860.aspx ("ISensLogon Interface") for more on that.
0
 

Author Comment

by:prunesquallor
ID: 22761368
Thanks for t comments. My immediate responses are:
 - Is it easy to programmatically read the event log (especially in real time - the program has to respond to the logon event)?
- I believe the Winlogon Notification Packages won't work under Vista (nor will GINAs), which alas puts them out of play.
- What I was looking for was if anyone had tried SENS vs Service Control Manager Notifications, and could recommedn either approach. Or is SENS the 'official' way to go?

ATB and thanks,

John B
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
LVL 86

Accepted Solution

by:
jkr earned 2000 total points
ID: 22761397
'SENS' is the official way for Vista, as the 'Winlogon Notification Packages' are for XP et. al. - both are not really hard to implement at all, you are just using a callback interface for SENS and a callback function for XP.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761403
BTW, reading the Event Log would mean "polling", which is something you usually want to really avoid.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 22761521
I have done something similar in the past. Adding the lines bellow to the logon script of all users you wish to affect will create a text log file of the user name, computer to which they have logged on, date and time, and the IP from which they have connected. Then the second part sends a pop up message to "ComputerName" that "UserName" has logged in. In order for this the windows messaging service needs to be enabled. Please advise if you need more details.

:Logging
If Exist "\\ServerName\Logs\LogOns.Log" GoTo START
Echo Log File > "\\ServerName\Logs\LogOns.Log"
:START
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,12%  %Time:~0,5% >> "\\ServerName\Logs\LogOns.Log"
Netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\ServerName\Logs\LogOns.Log"

:NOTIFY
Net Send ComputerName %username% logging on
:END

0
 

Author Closing Comment

by:prunesquallor
ID: 31507944
Thanks!
0
 

Author Comment

by:prunesquallor
ID: 22770185
Thanks, all. Looks like I'll be reading the SENS stuff. Sorry for the delay in getting back (dead machine).

JB
0

Featured Post

Want to be a Web Developer? Get Certified Today!

Enroll in the Certified Web Development Professional course package to learn HTML, Javascript, and PHP. Build a solid foundation to work toward your dream job!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction: Dialogs (2) modeless dialog and a worker thread.  Handling data shared between threads.  Recursive functions. Continuing from the tenth article about sudoku.   Last article we worked with a modal dialog to help maintain informat…
Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question