"Frank Gibbs" <fr****@dev.nor ac.com> wrote in message
news:%2******** ********@tk2msf tngp13.phx.gbl. ..
What will tell me that a logon event has occured in a windows service. I
don't need full credtitals just NT User Name.
Frank
On XP and higher you can use "local policies" to turn on "Logon auditing",
this will log the Logon event into the security eventlog. Your service can
then read the eventlog at regular intervals (and parse Message ID
551=Logoff, 528 = Logon) or, you can use System.Manageme nt's namespace
ManagementEvent Watcher and WMI to listen for security log events.
Another option, again on XP and higher) is the use System.Manageme nt's and
watch for Win32_LogonSess ion (WMI) instance creation events.
Willy.