Catching user logon/logoff events

[gewe]

Can anyone tell me what is wrong with the following code?
The code has to watch for logon/logoff events:

public void StartListenLogo n()
{
EventHandler handler = new EventHandler();
WqlEventQuery query = new WqlEventQuery() ;

query.EventClas sName = "__InstanceOper ationEvent";
query.WithinInt erval = new TimeSpan(0, 0, 3);
query.Condition = @"TargetInstanc e ISA 'Win32_LogonSes sion'";

LogonWatcher = new
System.Manageme nt.ManagementEv entWatcher(quer y);
LogonWatcher.Ev entArrived += new
EventArrivedEve ntHandler(handl er.Arrived);
LogonWatcher.St art();
}

public void Event_Arrived(o bject sender, EventArrivedEve ntArgs e)
{
//do something ...
}

The code is running in a Windows service.

When a user is logging on or logging off, no event is raised. Why?

If I change Win32_LogonSess ion into Win32_PnPEntity , I do get events
(like plugging in an USB device), even when no user is logged in. So
the code (and the service) seem to be working.