Каталог статей
Меню сайта


Форма входа


Категории раздела
Oracle DB [72]
Materials concerning Oracle database
Howto [24]
Все про Oracle [65]
Разработка на SQL и PL/SQL для Oracle, анализ работы базы
Построение Web-интерфейса: все что касается JSF, ADF и AJAX [9]
Разное [19]
Solaris [46]
Что касается администрирования Solaris
Linux [29]
Заметки по настройке Linux
AIX [1]
AIX, настройка Oracle на AIX
Java [15]
Cryptography [10]
Windows [1]
Java [35]
PostgreSQL [2]


Поиск


Друзья сайта
  • Официальный блог
  • Сообщество uCoz
  • FAQ по системе
  • Инструкции для uCoz


  • Статистика

    Онлайн всего: 1
    Гостей: 1
    Пользователей: 0


    Приветствую Вас, Гость · RSS 09.05.2024, 16:44
    Главная » Статьи » Windows

    Logging user in and out events
    How to log login anf logout as well as screen lock/unlock events.


    http://stackoverflow.com/questions/768314/detect-if-desktop-is-locked

    The answer depends on whether you want to know if the desktop is locked now, or if you want to be notified when the desktop gets locked (and, presumably, unlocked). It also depends on how you're planning to receive said notifications.

    • If you really want a one-off test, then the answer here uses OpenDesktop() and SwitchDesktop() to open a handle to the default desktop and activate it - if this fails then it's a good sign that the desktop is locked right now.

    • If you want notification on lock/unlock, and you have a user-mode application with a window and a message pump, then you need to call WTSRegisterSessionNotification() and catch the WM_WTSSESSION_CHANGE message.

    • If you want notifications, and you're running as a Windows service, then you can register for session change events by calling SetServiceStatus() and adding SERVICE_ACCEPT_SESSIONCHANGE to dwControlsAccepted in your status structure. You will then receive callbacks to your own service control HandlerEx() function with dwControl set to SERVICE_CONTROL_SESSIONCHANGE.

    Concerning logins and logouts:

    Event id 538 lists logons(with logon type of 7 being unlocks). See http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=528

    Event id 551 records user initiated logoffs
    http://www.ultimatewindowssecurity.com/securitylog/ency...

    Event id 528 lists successful logons(with logon type of 7 being locks).
    http://www.ultimatewindowssecurity.com/securitylog/ency...

    With these 3, splitting across days you could track who logs on & off and when they do it using WMI. Have a look at Chapter 10, lesson 4 of the .NET framework 2.0 application development foundation book

    You can audit your windows lock and unlock event when you enable

    Under Local Security Policy:

    LocalPolicies>AuditPolicy>Audit Account logon Events : Success,Failure
    LocalPolicies>AuditPolicy>Audit Logon Events : Success,Failure

    After you lock and unlock the workstation, look under
    Computer Management>Event Viewer>Windows Logs>Security.

    Look for Logon, Logoff on Task Category.






    Категория: Windows | Добавил: basil (12.12.2013)
    Просмотров: 592 | Комментарии: 2 | Рейтинг: 0.0/0
    Всего комментариев: 0
    Имя *:
    Email *:
    Код *:
    Бесплатный конструктор сайтов - uCoz