How to determine whether an LSA session is active in Windows XP

Question

I'm trying to get the list of users currently logged into a machine.

On Windows 7, I can call LsaEnumerateLogonSessions, then WTSQuerySessionInformation with WTSConnectState.

But on XP, each LSA session has 0 for the TS Session field (unless it's a Remote Desktop session), which always has WTSConnectState of WTSActive, and I end up listing all of the people who have logged out of the machine already. WTSQuerySessionInformation fails when the session is a Remote Desktop session.

Answer 1

Have you Tried the WMI class Win32_loggedOnUser

Answer 2

I believe this codeproject article uses a workaround that might be what you are after, it enumerates all running processes, checking the AuthenticationId (TokenStatistics on the process token) against the list of LUID's LsaEnumerateLogonSessions gives you. This allows you to filter out stale LUID's

Answer 3

I think with

I'm trying to get the list of users currently logged into a machine.

you want to enumerate all users that are logged on interactively, i.e. have a desktop and such. So it is the physical console and the RDP connections.

So you need to distinguish between "interactively logged on" and "logged on" because of "LogonUser" was called. With LogonUser you can spawn a process into a session of an interactive user or start a batch process. LSA returns all these users.

Use WTSEnumerateSessions and check if the session is in a state you need it to be.