Is there a programmatic way I can hook into user logins and logouts (Windows SBS 2003) with the goal of simple logging?

Question

I'm trying to write a central reporting tool that will allow time tracking based on Windows users logging into a domain. Initially I was going to create a small executable that would run on 'all users' start-up on each computer, track the logged in username and update a central database.

The main problems with this would be having to manage the versions on a machine by machine basis and deal with rare but possible instances of the tool failing on specific machines and not being immediately obvious.

Instead I would prefer to create a centralised version but I'm finding the MSDN and Windows SBS 2003 docs very hard to dig through for the answer.

Basically I would like to hook into the 'login' and 'logout' functions on the server and track all information from there. Are there natural extension points here?

Obviously an alternative may be to parse the event logs for the information (but to this point I can't find any windows logs that say 'who' is logging in or out).

Any guidance on the direction or documentation to look at would be really appreciated.

Answer 1

Not all logins will go to the dc. For example a laptop may use cached credentials to allow access when not on the domain.
You may also see multiple logins for the same user if they are accessing network resources. I think the most reliable approach would be to have the code running on each machine getting called from one of the login hooks.

Answer 2

You should look into the namespace called Microsoft.Win32.SystemEvents. There are many handlers there, but i believe what you want is the SessionSwitch event, which will tell you if the current user is logging on/off of the box or locks the screen. This is possible because windows switches to a different desktop when the screen is locked/unlocked, so you will be able to catch these. Then, to get the user information, you could use the UserPrincipal from System.DirectoryServices.AccountManagement namespace using the machine's principal context.