Notification of Logon and Logoff

Tech-Archive recommends: Fix windows errors by optimizing your registry

I'm trying to write a service that will sit on the domain controller (or, if
this proves to be impossible, to be rolled to all connecting Windows
machines).

It needs to get notification of each logon and logoff, capturing username &
IP address. I've currently got a test application to check the inputs &
outputs and the business logic is using EventLog_OnEntryWritten to trap 538's
& 540's. Unfortunately (and peculiarly) a physical logon logs multiple logon
and logoff events, and a logoff does the same (albeit only a few extras).
Since each one triggers an event in the logic, part of which records the
state, the user can be (after logon) in either a state of logged on or logged
off.

Does anybody have a definitive method for capturing logon & logoff events?
.

Relevant Pages

  • Re: Event Logging
    ... If you have auditing of logon and logoff events enabled, ... EventLog on these events, export them to a comma-delimited textfile ... If you enable auditing of security events, ...
    (microsoft.public.windows.terminal_services)
  • Re: Notification of Logon and Logoff
    ... rather just the workstation id from the event itself. ... It needs to get notification of each logon and logoff, capturing username ... Does anybody have a definitive method for capturing logon & logoff events? ...
    (microsoft.public.dotnet.languages.csharp)
  • Maintaining state in Winlogon notification packages
    ... state (e.g. logon time) for Logon and Logoff events. ... interactive session in the session table, rather than the info on the ...
    (microsoft.public.platformsdk.security)
  • Re: Audit Terminal Server Session
    ... Just enable auditing of security events in your domain (Logon and ... Logoff events: Success and Failure), and you will be able to see all ... logon and logoff events in the Security tab of the EventViewer. ... MCSE, CCEA, Microsoft MVP - Terminal Server ...
    (microsoft.public.win2000.termserv.apps)