Hook windows logon/logoff events

Question

I am having a service which would be running at SYSTEM level. Now, i want to track the logged on user in it. Earlier i was trying to get the logged in user name from GetUserName api but in my case it returns "SYSTEM" every time.

Is there anyway to get logged on username in my case? or is there any hook that i can install so that i may get which user logged on?

P.S: I am mainly working in Delphi 2007 but these question are win32 (native api) specific.

Answer 1

You can use SENS to listen to subscribe to log-in notifications.

Answer 2

You need to be more specific in your requirements. There may be multiple users logged on at any given time, either locally or remotely. Do you only care about interactive users?

The most common request is how to get the locally logged-on interactive user, i.e. the person who is physically sat at the keyboard and screen. There are various issues that you must consider before you decide how to proceed. MSDN has a good entry on Window Stations that will explain the situation better than I can.

Answer 3

I am unfamiliar with Delphi's implementation of Windows services but wherever you set the controls accepted by the service you should add SERVICE_ACCEPT_SESSIONCHANGE. Then in your HandlerEx callback function the dwEventType parameter will be one of the WM_WTSSESSION_CHANGE values and the lpEventData will be a pointer to a WTSSESSION_NOTIFICATION structure that contains the session ID of the event.

You can use this info along with the terminal services API to determine who did what.

Answer 4

@ Stephen That was quite helpful. At least i have some points to search on. I'll try to implement the given things in delphi (i.e the callbacks to WM_WTSSESSION_CHANGE).

Answer 5

@ Stephen I got some reference code which is doing exactly what you mentioned. I'll have "session id" at the end of that code. But how can i use that session id to retrieve the user name?