Records System Session Events Triggered Time Like Shutdown, Lock/Unlock, LogOn/LogOff Using Windows Service

This blog explains how to record system events such as Windows Lock/Unlock, LogOn/LogOff, Shutdown in C#.

This project is a Windows Service in which we will see how to record some system events. After that, we will see how to install/register the Services and run it locally.

1. Create a new Windows Service project in Visual Studio. 
2. Note you'll see Service1.cs file by default added to project.
3. Open that you will see the designer view.
4. Now switch to the code view by pressing F7 or click on link switch to code view.
5. In code, you'll notice there are two methods by default OnStart() and OnStop(). Generally, these two methods are called when Service starts and Stops respectively. And we can use this to perform any operation during the service start or stop like record a log that service started and stopped.
6. Now we need to work on System Session related Events like logon/logoff etc. How can we achieve it?
7. We need to override OnSessionChange() method to the class. 
8. As you can see it has a parameter called SessionChangeDescription. This provides us the reason for the change of session. Obviously, your next question is what kind of reasons are these? The reason states why OnSessionChange is triggered which may due to SessionLogon, RemoteConnect, SessionLock,etc.

So, how can we log the datetime when does this event happen? For that, we will create a switch-case statement as shown in the code below.

protected override void OnSessionChange(SessionChangeDescription changeDescription)
        {
            if (!File.Exists(logPath))
            {
                File.Create(logPath).Close();
            }

            switch (changeDescription.Reason)
            {
                case SessionChangeReason.SessionLogon:
                    File.AppendAllText(logPath, ">>> System Log On Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionLogoff:
                    File.AppendAllText(logPath, ">>> System Log Off Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.RemoteConnect:
                    File.AppendAllText(logPath, ">>> System Remote Connect Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.RemoteDisconnect:
                    File.AppendAllText(logPath, ">>> System Remote Disconnect Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionLock:
                    File.AppendAllText(logPath, ">>> System Locked Time: \t" + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionUnlock:
                    File.AppendAllText(logPath, ">>> System Unlocked Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                default:
                    break;
            }
        }

Note: I've referenced System.IO namespace and provided logPath value to record the logs in one location.

 

My Service Class

public partial class SysService : ServiceBase
    {
        string logPath = "D:\\SystemLogs.txt";

        public SysService()
        {
            InitializeComponent();
        }

        protected override void OnStart(string[] args)
        {
            if (!File.Exists(logPath))
            {
                File.Create(logPath).Close();
            }

            File.AppendAllText(logPath, Environment.NewLine + ">>>> Datetime:" + DateTime.Now + ">>> Service Started");


        }

        protected override void OnSessionChange(SessionChangeDescription changeDescription)
        {
            if (!File.Exists(logPath))
            {
                File.Create(logPath).Close();
            }

            switch (changeDescription.Reason)
            {
                case SessionChangeReason.SessionLogon:
                    File.AppendAllText(logPath, ">>> System Log On Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionLogoff:
                    File.AppendAllText(logPath, ">>> System Log Off Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.RemoteConnect:
                    File.AppendAllText(logPath, ">>> System Remote Connect Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.RemoteDisconnect:
                    File.AppendAllText(logPath, ">>> System Remote Disconnect Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionLock:
                    File.AppendAllText(logPath, ">>> System Locked Time: \t" + DateTime.Now + Environment.NewLine);
                    break;
                case SessionChangeReason.SessionUnlock:
                    File.AppendAllText(logPath, ">>> System Unlocked Time: \t " + DateTime.Now + Environment.NewLine);
                    break;
                default:
                    break;
            }
        }
        protected override void OnShutdown()
        {
            if (!File.Exists(logPath))
            {
                File.Create(logPath).Close();
            }
            File.AppendAllText(logPath, ">>> System Turn Off Time: \n " + DateTime.Now + Environment.NewLine);
        }

        protected override void OnStop()
        {
            if (!File.Exists(logPath))
            {
                File.Create(logPath).Close();
            }

            File.AppendAllText(logPath, Environment.NewLine + ">>>> Datetime:" + DateTime.Now + ">>> Service Stopped");

        }
    }

Now, what you thing would this run as expected? No, it would required two properties need to be changed. Go to Service.cs design file properties and update below highlighted 2 properties value to true. 

 

Basically, this allows the service to handle SessionChange event.

 

Thats it now we have created a service. Now how can we Install this service.

1. When we created a service lets build it once. Now assembly package(.exe) would be generated with the service name which ever you've given.
2. Open VS Dev command prompt (Administrator) and navigate to your project assembly package. Now type InstallUtil.exe <path to this exe in bin/debug folder/{assembly name}> and hit enter as shown below. And service would be installed. To uninstall the service type InstallUtil.exe /u <path to this exe in bin/debug folder> and hit enter.  

Once the service is installed, you can navigate to Services.msc and start you service. And see the output in SystemLogs.txt file where you located the path.

 

Hope you liked this :)

 

If you're new to Windows Services, read tutorial: Create a Windows Service in C#.