CODEWITHSUNDEEP
c#delphiwinapi
Craig Stevensson
Craig Stevensson

Reputation: 1336

How to check the current user logged in and time logged

I need to create a Windows service that checks when a user logs in windows (in a computer with several users) and when the users logs out (or lock the computer) and with this information calculate the time the user has been logged in (I don't care about idle time) or better if I can get this last piece directly. (I don't mind if the user pull the cord, the service will be polling the current user and logging this information so I will know if the computer was turned off that way the next time it wakes up. It does not has to be exact).

I need to know this in order to kick the user out when they exceed certain limit of time.

I will be using either C# or Delphi, I'd appreciate to point me out which API's to look for to get this information.

There's already software around that checks this like that targeted to check the kids computer usage, I need something like that, but I will customize for another purpose than watch kids.

Actually, I may just need to know when the user logged in, and from that I will calculate the rest on my own.

Upvotes: 2

Views: 4205

Answers (3)

Oleg
Oleg

Reputation: 221997

The origin of the information come from SECURITY_LOGON_SESSION_DATA. You can use LsaGetLogonSessionData or LsaEnumerateLogonSessions. To get session Id of the thread (or user logon token) you can use GetTokenInformation with TokenSessionId as parameter.

In the old answer you will find the source code of the small demo.

If you need monitor user login and logoff I would recommend you to implement ISensLogon2 callback interface (see of the System Event Notification Service (SENS)) in your windows service. If you plan use it in C# I would recommend you the article.

Upvotes: 2

RRUZ
RRUZ

Reputation: 136391

Try the Win32_LogonSession WMI class, check the StartTime, LogonId and LogonType properties. Also you can take a look to the Win32_Session class.

Upvotes: 3

Moo-Juice
Moo-Juice

Reputation: 38825

You'll need to probably interrogate the windows event log to get this information. Eric Fitzgerald talks about some of this here. Note also that he links to here, on how relying on the "LogOff" event is, well, unreliable. This mentions my comment above, about people pulling out the power-chord.

The articles also mention the idiosyncrasies involved, such as the work-station being locked, etc...

Upvotes: 0

Related Questions