胡克Windows登录/注销事件 [英] Hook windows logon/logoff events

问题描述

我有这将在系统级运行的服务。现在，我想跟踪用户在它记录下来。早些时候，我试图让从GetUserName API的用户名登录，但在我的情况下，它会返回SYSTEM每次。

I am having a service which would be running at SYSTEM level. Now, i want to track the logged on user in it. Earlier i was trying to get the logged in user name from GetUserName api but in my case it returns "SYSTEM" every time.

反正在我的情况得到登录的用户名？或者是有，我可以安装，这样我可能会得到该用户登录任何挂机？

Is there anyway to get logged on username in my case? or is there any hook that i can install so that i may get which user logged on?

P.S：
我的主要工作在2007年德尔福但这些问题是特定于Win32 API的。

P.S: I am mainly working in Delphi 2007 but these question are specific to the Win32 API.

推荐答案

我不熟悉德尔福的实现Windows服务，但无论你设置由服务接受控制你应该添加SERVICE_ACCEPT_SESSIONCHANGE。然后在HandlerEx回调函数dwEventType参数将是WM_WTSSESSION_CHANGE值之一和lpEventData将是一个指向包含该事件的会话ID的WTSSESSION_NOTIFICATION结构

I am unfamiliar with Delphi's implementation of Windows services but wherever you set the controls accepted by the service you should add SERVICE_ACCEPT_SESSIONCHANGE. Then in your HandlerEx callback function the dwEventType parameter will be one of the WM_WTSSESSION_CHANGE values and the lpEventData will be a pointer to a WTSSESSION_NOTIFICATION structure that contains the session ID of the event.

您可以使用此信息与终端服务API一起，以确定谁做了什么。

You can use this info along with the terminal services API to determine who did what.

这篇关于胡克Windows登录/注销事件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！