Solved

Detecting Windows Logon events in XP/Vista

Posted on 2008-10-20
8
2,694 Views
Last Modified: 2013-12-04
I'me developing and application where I need to detect logons and then display something when somebody has actually logged on. Note that the customer has specified 'logon' as any time a user goes through a signon screen (thus a workstation unlock counts as a logon here).

This is going to be used in Vista in the future, so Winlogon Notification Packages seem to be out, as does the GINA approach.

My readings imply that I have two ways to go:
- Service Control Manager Notifications (which seem to provide lock/unlock/logoff/logon states)
- the System Events Notification Service (which provides ISensLogon methods for the four above, plus others such as StartShell and StopScreenSaver).

Has anybody used or played with the above, and can they give comments on which is the best way to go? Note that the application will have to be able to look across different logons, so I suspect it will end up as a service. On the other hand, I'm still at the thinking stage so nothing's cast in stone.

Any and all comments welcome!                                    

John B
0
Comment
Question by:prunesquallor
8 Comments
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 22761126
Longshot here but what about turning on security logging for successful events. This would create an event in the event viewer for each successful logon/authentication.
0
 
LVL 86

Expert Comment

by:jkr
ID: 22761291
No need to use a GINA here, take a look at "Winlogon Notification Packages": http://msdn.microsoft.com/en-us/library/aa380545.aspx

The pages linked from there will give you detailed information on how to handle the events described at http://msdn.microsoft.com/en-us/library/aa380544(VS.85).aspx ("Winlogon Notification Events")

On Vista, these are superseded by the System Event Notification Service (SENS) - see http://msdn.microsoft.com/en-us/library/aa376860.aspx ("ISensLogon Interface") for more on that.
0
 

Author Comment

by:prunesquallor
ID: 22761368
Thanks for t comments. My immediate responses are:
 - Is it easy to programmatically read the event log (especially in real time - the program has to respond to the logon event)?
- I believe the Winlogon Notification Packages won't work under Vista (nor will GINAs), which alas puts them out of play.
- What I was looking for was if anyone had tried SENS vs Service Control Manager Notifications, and could recommedn either approach. Or is SENS the 'official' way to go?

ATB and thanks,

John B
0
 
LVL 86

Accepted Solution

by:
jkr earned 500 total points
ID: 22761397
'SENS' is the official way for Vista, as the 'Winlogon Notification Packages' are for XP et. al. - both are not really hard to implement at all, you are just using a callback interface for SENS and a callback function for XP.
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 86

Expert Comment

by:jkr
ID: 22761403
BTW, reading the Event Log would mean "polling", which is something you usually want to really avoid.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 22761521
I have done something similar in the past. Adding the lines bellow to the logon script of all users you wish to affect will create a text log file of the user name, computer to which they have logged on, date and time, and the IP from which they have connected. Then the second part sends a pop up message to "ComputerName" that "UserName" has logged in. In order for this the windows messaging service needs to be enabled. Please advise if you need more details.

:Logging
If Exist "\\ServerName\Logs\LogOns.Log" GoTo START
Echo Log File > "\\ServerName\Logs\LogOns.Log"
:START
Echo Log On:  %USERNAME% %COMPUTERNAME%  %Date:~0,12%  %Time:~0,5% >> "\\ServerName\Logs\LogOns.Log"
Netstat  -an  |find  "3389"  |find  /I  "established"  >> "\\ServerName\Logs\LogOns.Log"

:NOTIFY
Net Send ComputerName %username% logging on
:END

0
 

Author Closing Comment

by:prunesquallor
ID: 31507944
Thanks!
0
 

Author Comment

by:prunesquallor
ID: 22770185
Thanks, all. Looks like I'll be reading the SENS stuff. Sorry for the delay in getting back (dead machine).

JB
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Introduction: Dialogs (2) modeless dialog and a worker thread.  Handling data shared between threads.  Recursive functions. Continuing from the tenth article about sudoku.   Last article we worked with a modal dialog to help maintain informat…
A theme is a collection of property settings that allow you to define the look of pages and controls, and then apply the look consistently across pages in an application. Themes can be made up of a set of elements: skins, style sheets, images, and o…
This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now