Unable to capture SessionSwitch events in windows from application

Question

Unable to capture SessionSwitch events in windows from application

Raghu Ravinuthala 10

We are using C# “SystemEvents.SessionSwitch” events to monitor System Lock/Unlock. In some machines, we are facing an issue with the SessionSwitch events, not being triggered. We have major functionality that depends on System Lock/Unlock. This behavior of not triggering these events is intermittent. We observe the same in Windows 10 and Windows 11.

How can we find out if any other application suppressing this event?

Anonymous

2023-05-29T09:34:40.4033333+00:00

Hi @Raghu Ravinuthala , Welcome to Microsoft Q&A. Do you have the same problem on different machines with windows 10 and 11? I don't know what software on your computer is causing this problem. Have you considered trying to use WMI or Windows API functions instead of C# "SystemEvents.SessionSwitch" events? Can't you trigger it under compile environment too?
Raghu Ravinuthala 10 Reputation points

2023-05-29T09:54:11.3633333+00:00

we are facing this issue on random machines. In the same machine also sometimes it works.
Anonymous

2023-05-30T03:01:00.65+00:00

Have you considered trying to use WMI or Windows API functions instead of C# "SystemEvents.SessionSwitch" events?
Raghu Ravinuthala 10 Reputation points

2023-06-01T10:49:46.76+00:00

Not Yet. Do we have any issues with "SystemEvents.SessionSwitch"?. We are using this in Windows Forms and Winui 3 .

Any specific way how can we use WMI?

Anonymous

Because I don't know what software on your computer affects SystemEvents.SessionSwitch, so I can't help you solve the problem.

Regarding using WMI, you can test the code below:

using System;
using System.Management;

namespace _6_2_x
{
    internal class Program
    {
        static void Main(string[] args)
        {
            MonitorLockState();
        }
        public static void LockStateChangedEvent(object sender, EventArrivedEventArgs e)
        {
            ManagementBaseObject targetObject = (ManagementBaseObject)e.NewEvent["TargetInstance"];
            string eventType = (string)targetObject["EventType"];

            if (eventType.Equals("1"))
            {
                Console.WriteLine("System locked");
            }
            else if (eventType.Equals("2"))
            {
                Console.WriteLine("System unlocked");
            }
        }

        public static void MonitorLockState()
        {
            ManagementEventWatcher watcher = new ManagementEventWatcher("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventIdentifier = '4800' OR TargetInstance.EventIdentifier = '4801'");
            watcher.EventArrived += new EventArrivedEventHandler(LockStateChangedEvent);
            watcher.Start();
            System.Threading.Thread.Sleep(System.Threading.Timeout.Infinite);
            watcher.Stop();
        }
    }
}

Anonymous

2023-12-11T02:48:42.8766667+00:00

Is there any update in this issue?
Sebastian Schellenberg 0 Reputation points

2024-01-05T08:35:01.4966667+00:00

I have just stumbled across the same problem. For many years we have been using our own software (WPF .NET 4) to display the availability of colleagues at work. Since this week I have noticed that it no longer works properly. The event "SystemEvents.SessionSwitch" is no longer triggered. Nothing has changed in the programme, it has always worked so far.

I have just started the programme in the debugger and I am not getting the event there either.

Is it related to a Windows update? (Win 10 Pro 22H2)
Rohith B 0 Reputation points

2024-02-07T09:04:57.7033333+00:00

Hi @Anonymous . Thanks for your information. Few queries on capturing Lock and Unlock event. We are developing a Windows application which requires to capture Screen lock and Unlock , how can we do it except for SessionSwitchEvent because its not getting Triggered few time. So anything else you could help us out maybe with Windows API function as you suggested earlier . If you have some ready code it could help us .

1 answer

Your answer

Anonymous

2023-05-29T09:34:40.4033333+00:00

Hi @Raghu Ravinuthala , Welcome to Microsoft Q&A. Do you have the same problem on different machines with windows 10 and 11? I don't know what software on your computer is causing this problem. Have you considered trying to use WMI or Windows API functions instead of C# "SystemEvents.SessionSwitch" events? Can't you trigger it under compile environment too?
Raghu Ravinuthala 10 Reputation points

2023-05-29T09:54:11.3633333+00:00

we are facing this issue on random machines. In the same machine also sometimes it works.
Anonymous

2023-05-30T03:01:00.65+00:00

Have you considered trying to use WMI or Windows API functions instead of C# "SystemEvents.SessionSwitch" events?
Raghu Ravinuthala 10 Reputation points

2023-06-01T10:49:46.76+00:00

Not Yet. Do we have any issues with "SystemEvents.SessionSwitch"?. We are using this in Windows Forms and Winui 3 .

Any specific way how can we use WMI?
Anonymous

2023-06-02T09:34:20.25+00:00

Because I don't know what software on your computer affects SystemEvents.SessionSwitch, so I can't help you solve the problem.

Regarding using WMI, you can test the code below:

using System; using System.Management; namespace _6_2_x { internal class Program { static void Main(string[] args) { MonitorLockState(); } public static void LockStateChangedEvent(object sender, EventArrivedEventArgs e) { ManagementBaseObject targetObject = (ManagementBaseObject)e.NewEvent["TargetInstance"]; string eventType = (string)targetObject["EventType"]; if (eventType.Equals("1")) { Console.WriteLine("System locked"); } else if (eventType.Equals("2")) { Console.WriteLine("System unlocked"); } } public static void MonitorLockState() { ManagementEventWatcher watcher = new ManagementEventWatcher("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventIdentifier = '4800' OR TargetInstance.EventIdentifier = '4801'"); watcher.EventArrived += new EventArrivedEventHandler(LockStateChangedEvent); watcher.Start(); System.Threading.Thread.Sleep(System.Threading.Timeout.Infinite); watcher.Stop(); } } }
Anonymous

2023-12-11T02:48:42.8766667+00:00

Is there any update in this issue?
Sebastian Schellenberg 0 Reputation points

2024-01-05T08:35:01.4966667+00:00

I have just stumbled across the same problem. For many years we have been using our own software (WPF .NET 4) to display the availability of colleagues at work. Since this week I have noticed that it no longer works properly. The event "SystemEvents.SessionSwitch" is no longer triggered. Nothing has changed in the programme, it has always worked so far.

I have just started the programme in the debugger and I am not getting the event there either.

Is it related to a Windows update? (Win 10 Pro 22H2)
Rohith B 0 Reputation points

2024-02-07T09:04:57.7033333+00:00

Hi @Anonymous . Thanks for your information. Few queries on capturing Lock and Unlock event. We are developing a Windows application which requires to capture Screen lock and Unlock , how can we do it except for SessionSwitchEvent because its not getting Triggered few time. So anything else you could help us out maybe with Windows API function as you suggested earlier . If you have some ready code it could help us .

Answer 1

This quick test with ISensLogon seems to work on my PC (Windows 10 22H2), tested with Lock/Unlock and ScreenSaver events => (test in a Button Click to register events)

public partial class Form1 : Form
{
    public enum HRESULT : int
    {
        S_OK = 0,
        S_FALSE = 1,
        E_NOINTERFACE = unchecked((int)0x80004002),
        E_NOTIMPL = unchecked((int)0x80004001),
        E_FAIL = unchecked((int)0x80004005)
    }

    [ComImport]
    [Guid("d597bab3-5b9f-11d1-8dd2-00aa004abd5e")]
    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
    public interface ISensLogon
    {
        #region <IDispatch>
        int GetTypeInfoCount();
        [return: MarshalAs(UnmanagedType.Interface)]
        IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
        [PreserveSig]
        HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
            [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
        [PreserveSig]
        HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
            [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
        #endregion

        [PreserveSig]
        HRESULT Logon(string stringUserName);
        [PreserveSig]
        HRESULT Logoff(string stringUserName);
        [PreserveSig]
        HRESULT StartShell(string stringUserName);
        [PreserveSig]
        HRESULT DisplayLock(string stringUserName);
        [PreserveSig]
        HRESULT DisplayUnlock(string stringUserName);
        [PreserveSig]
        HRESULT StartScreenSaver(string stringUserName);
        [PreserveSig]
        HRESULT StopScreenSaver(string stringUserName);
    }

    [ComImport]
    [Guid("4A6B0E15-2E38-11D1-9965-00C04FBBB345")]
    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
    public interface IEventSubscription
    {
        #region <IDispatch>
        int GetTypeInfoCount();
        [return: MarshalAs(UnmanagedType.Interface)]
        IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
        [PreserveSig]
        HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
            [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
        [PreserveSig]
        HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
            [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
        #endregion

        HRESULT get_SubscriptionID(out string pstringSubscriptionID);
        HRESULT put_SubscriptionID(string stringSubscriptionID);
        HRESULT get_SubscriptionName(out string pstringSubscriptionName);
        HRESULT put_SubscriptionName(string stringSubscriptionName);
        HRESULT get_PublisherID(out string pstringPublisherID);
        HRESULT put_PublisherID(string stringPublisherID);
        HRESULT get_EventClassID(out string pstringEventClassID);
        HRESULT put_EventClassID(string stringEventClassID);
        HRESULT get_MethodName(out string pstringMethodName);
        HRESULT put_MethodName(string stringMethodName);
        HRESULT get_SubscriberCLSID(out string pstringSubscriberCLSID);
        HRESULT put_SubscriberCLSID(string stringSubscriberCLSID);
        HRESULT get_SubscriberInterface(out IntPtr ppSubscriberInterface);
        HRESULT put_SubscriberInterface(IntPtr pSubscriberInterface);
        HRESULT get_PerUser(out bool pfPerUser);
        HRESULT put_PerUser(bool fPerUser);
        HRESULT get_OwnerSID(out string pstringOwnerSID);
        HRESULT put_OwnerSID(string stringOwnerSID);
        HRESULT get_Enabled(out bool pfEnabled);
        HRESULT put_Enabled(bool fEnabled);
        HRESULT get_Description(out string pstringDescription);
        HRESULT put_Description(string stringDescription);
        HRESULT get_MachineName(out string pstringMachineName);
        HRESULT put_MachineName(string stringMachineName);
        //HRESULT GetPublisherProperty(string stringPropertyName, out VARIANT propertyValue);
        HRESULT GetPublisherProperty(string stringPropertyName, out object propertyValue);
        //HRESULT PutPublisherProperty(string stringPropertyName, VARIANT propertyValue);
        HRESULT PutPublisherProperty(string stringPropertyName, object propertyValue);
        HRESULT RemovePublisherProperty(string stringPropertyName);
        //HRESULT GetPublisherPropertyCollection(out IEventObjectCollection collection);
        HRESULT GetPublisherPropertyCollection(out IntPtr collection);
        //HRESULT GetSubscriberProperty(string stringPropertyName, out VARIANT propertyValue);
        HRESULT GetSubscriberProperty(string stringPropertyName, out object propertyValue);
        //HRESULT PutSubscriberProperty(string stringPropertyName, VARIANT propertyValue);
        HRESULT PutSubscriberProperty(string stringPropertyName, object propertyValue);
        HRESULT RemoveSubscriberProperty(string stringPropertyName);
        //HRESULT GetSubscriberPropertyCollection(out IEventObjectCollection collection);
        HRESULT GetSubscriberPropertyCollection(out IntPtr collection);
        HRESULT get_InterfaceID(out string pstringInterfaceID);
        HRESULT put_InterfaceID(string stringInterfaceID);
    }

    [ComImport]
    [Guid("4E14FB9F-2E22-11D1-9964-00C04FBBB345")]
    [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
    public interface IEventSystem
    {
        #region <IDispatch>
        int GetTypeInfoCount();
        [return: MarshalAs(UnmanagedType.Interface)]
        IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
        [PreserveSig]
        HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
            [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
        [PreserveSig]
        HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
            [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
        #endregion

        [PreserveSig]
        HRESULT Query(string progID, string queryCriteria, out int errorIndex, out IntPtr ppInterface);
        [PreserveSig]
        HRESULT Store(string ProgID, IntPtr pInterface);
        [PreserveSig]
        HRESULT Remove(string progID, string queryCriteria, out int errorIndex);
        [PreserveSig]
        HRESULT get_EventObjectChangeEventClassID(out string pbstrEventClassID);
        [PreserveSig]
        HRESULT QueryS(string progID, string queryCriteria, out IntPtr ppInterface);
        [PreserveSig]
        HRESULT RemoveS(string progID, string queryCriteria);
    }

    public class CSensEvent : ISensLogon
    {
        IEventSystem m_pEventSystem = null;
        
        int ISensLogon.GetTypeInfoCount()
        {
            throw new NotImplementedException();
        }

        IntPtr ISensLogon.GetTypeInfo(int iTInfo, int lcid)
        {
            throw new NotImplementedException();
        }

        HRESULT ISensLogon.GetIDsOfNames(ref Guid riid, string[] rgszNames, int cNames, int lcid, int[] rgDispId)
        {
            throw new NotImplementedException();
        }

        HRESULT ISensLogon.Invoke(int dispIdMember, ref Guid riid, int lcid, int dwFlags, System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, out object pVarResult, System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, IntPtr[] pArgErr)
        {
            throw new NotImplementedException();
        }

        HRESULT ISensLogon.Logon(string stringUserName)
        {
            Console.Beep(1000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.Logoff(string stringUserName)
        {
            Console.Beep(2000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.StartShell(string stringUserName)
        {
            Console.Beep(8000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.DisplayLock(string stringUserName)
        {
            Console.Beep(5000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.DisplayUnlock(string stringUserName)
        {
            Console.Beep(6000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.StartScreenSaver(string stringUserName)
        {
            Console.Beep(3000, 10);
            return HRESULT.S_OK;
        }

        HRESULT ISensLogon.StopScreenSaver(string stringUserName)
        {
            Console.Beep(4000, 10);
            return HRESULT.S_OK;
        }

        public HRESULT Initialize()
        {
            HRESULT hr = HRESULT.E_FAIL;
            Guid CLSID_CEventSubscription = new Guid("7542e960-79c7-11d1-88f9-0080c7d771bf");
            Type EventSubscriptionType = Type.GetTypeFromCLSID(CLSID_CEventSubscription, true);
            object EventSubscription = Activator.CreateInstance(EventSubscriptionType);
            IEventSubscription pEventSubscription = (IEventSubscription)EventSubscription;
            if (pEventSubscription != null)
            {
                hr = pEventSubscription.put_EventClassID("{D5978630-5B9F-11D1-8DD2-00AA004ABD5E}");
                if (hr == HRESULT.S_OK)
                {
                    hr = pEventSubscription.put_SubscriptionName("TestISensLogon");
                    if (hr == HRESULT.S_OK)
                    {
                        hr = pEventSubscription.put_PerUser(true);                            
                        if (hr == HRESULT.S_OK)
                        {
                            IntPtr pSubscriberInterface = Marshal.GetIUnknownForObject(this);
                            hr = pEventSubscription.put_SubscriberInterface(pSubscriberInterface);
                            Guid CLSID_CEventSystem = new Guid("4E14FBA2-2E22-11D1-9964-00C04FBBB345");
                            Type EventSystemType = Type.GetTypeFromCLSID(CLSID_CEventSystem, true);
                            object EventSystem = Activator.CreateInstance(EventSystemType);
                            m_pEventSystem = (IEventSystem)EventSystem;
                            IntPtr pInterface = Marshal.GetIUnknownForObject(pEventSubscription);
                            hr = m_pEventSystem.Store("EventSystem.EventSubscription", pInterface);
                        }
                    }
                }
                Marshal.ReleaseComObject(pEventSubscription);
            }

            return hr;
        }

        public HRESULT UnInitialize()
        {
            HRESULT hr = HRESULT.E_FAIL;
            if (m_pEventSystem != null)
            {
                // System.UnauthorizedAccessException
                // HResult = 0x80070005
                // Message = Accès refusé. (Exception de HRESULT: 0x80070005(E_ACCESSDENIED))
 
                int nErrorIndex = 0;
                hr = m_pEventSystem.Remove("EventSystem.EventSubscription", "EventClassID={D5978630-5B9F-11D1-8DD2-00AA004ABD5E}", out nErrorIndex);
                Marshal.ReleaseComObject(m_pEventSystem);
            }
            return hr;
        }
    }

    CSensEvent m_pSensEvent = null;

    public Form1()
    {
        InitializeComponent();
        this.FormClosed += new System.Windows.Forms.FormClosedEventHandler(this.Form1_FormClosed);
    }

    private void button1_Click(object sender, EventArgs e)
    {
        m_pSensEvent = new CSensEvent();
        m_pSensEvent.Initialize();
    }

    private void Form1_FormClosed(object sender, FormClosedEventArgs e)
    {
        if (m_pSensEvent != null)
        {
            m_pSensEvent.UnInitialize();
        }
    }
}

Share via

Unable to capture SessionSwitch events in windows from application

1 answer

Your answer