Unable to capture SessionSwitch events in windows from application

Raghu Ravinuthala 10 Reputation points
2023-05-29T06:18:07.9133333+00:00

We are using C# “SystemEvents.SessionSwitch” events to monitor System Lock/Unlock. In some machines, we are facing an issue with the SessionSwitch events, not being triggered. We have major functionality that depends on System Lock/Unlock. This behavior of not triggering these events is intermittent. We observe the same in Windows 10 and Windows 11.

How can we find out if any other application suppressing this event?

Windows Forms
Windows Forms
A set of .NET Framework managed libraries for developing graphical user interfaces.
1,869 questions
C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,605 questions
{count} vote

1 answer

Sort by: Most helpful
  1. Castorix31 83,096 Reputation points
    2024-02-07T14:17:41.6366667+00:00

    This quick test with ISensLogon seems to work on my PC (Windows 10 22H2), tested with Lock/Unlock and ScreenSaver events => (test in a Button Click to register events)

    public partial class Form1 : Form
    {
        public enum HRESULT : int
        {
            S_OK = 0,
            S_FALSE = 1,
            E_NOINTERFACE = unchecked((int)0x80004002),
            E_NOTIMPL = unchecked((int)0x80004001),
            E_FAIL = unchecked((int)0x80004005)
        }
    
        [ComImport]
        [Guid("d597bab3-5b9f-11d1-8dd2-00aa004abd5e")]
        [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
        public interface ISensLogon
        {
            #region <IDispatch>
            int GetTypeInfoCount();
            [return: MarshalAs(UnmanagedType.Interface)]
            IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
            [PreserveSig]
            HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
                [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
            [PreserveSig]
            HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
                [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
            #endregion
    
            [PreserveSig]
            HRESULT Logon(string stringUserName);
            [PreserveSig]
            HRESULT Logoff(string stringUserName);
            [PreserveSig]
            HRESULT StartShell(string stringUserName);
            [PreserveSig]
            HRESULT DisplayLock(string stringUserName);
            [PreserveSig]
            HRESULT DisplayUnlock(string stringUserName);
            [PreserveSig]
            HRESULT StartScreenSaver(string stringUserName);
            [PreserveSig]
            HRESULT StopScreenSaver(string stringUserName);
        }
    
        [ComImport]
        [Guid("4A6B0E15-2E38-11D1-9965-00C04FBBB345")]
        [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
        public interface IEventSubscription
        {
            #region <IDispatch>
            int GetTypeInfoCount();
            [return: MarshalAs(UnmanagedType.Interface)]
            IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
            [PreserveSig]
            HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
                [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
            [PreserveSig]
            HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
                [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
            #endregion
    
            HRESULT get_SubscriptionID(out string pstringSubscriptionID);
            HRESULT put_SubscriptionID(string stringSubscriptionID);
            HRESULT get_SubscriptionName(out string pstringSubscriptionName);
            HRESULT put_SubscriptionName(string stringSubscriptionName);
            HRESULT get_PublisherID(out string pstringPublisherID);
            HRESULT put_PublisherID(string stringPublisherID);
            HRESULT get_EventClassID(out string pstringEventClassID);
            HRESULT put_EventClassID(string stringEventClassID);
            HRESULT get_MethodName(out string pstringMethodName);
            HRESULT put_MethodName(string stringMethodName);
            HRESULT get_SubscriberCLSID(out string pstringSubscriberCLSID);
            HRESULT put_SubscriberCLSID(string stringSubscriberCLSID);
            HRESULT get_SubscriberInterface(out IntPtr ppSubscriberInterface);
            HRESULT put_SubscriberInterface(IntPtr pSubscriberInterface);
            HRESULT get_PerUser(out bool pfPerUser);
            HRESULT put_PerUser(bool fPerUser);
            HRESULT get_OwnerSID(out string pstringOwnerSID);
            HRESULT put_OwnerSID(string stringOwnerSID);
            HRESULT get_Enabled(out bool pfEnabled);
            HRESULT put_Enabled(bool fEnabled);
            HRESULT get_Description(out string pstringDescription);
            HRESULT put_Description(string stringDescription);
            HRESULT get_MachineName(out string pstringMachineName);
            HRESULT put_MachineName(string stringMachineName);
            //HRESULT GetPublisherProperty(string stringPropertyName, out VARIANT propertyValue);
            HRESULT GetPublisherProperty(string stringPropertyName, out object propertyValue);
            //HRESULT PutPublisherProperty(string stringPropertyName, VARIANT propertyValue);
            HRESULT PutPublisherProperty(string stringPropertyName, object propertyValue);
            HRESULT RemovePublisherProperty(string stringPropertyName);
            //HRESULT GetPublisherPropertyCollection(out IEventObjectCollection collection);
            HRESULT GetPublisherPropertyCollection(out IntPtr collection);
            //HRESULT GetSubscriberProperty(string stringPropertyName, out VARIANT propertyValue);
            HRESULT GetSubscriberProperty(string stringPropertyName, out object propertyValue);
            //HRESULT PutSubscriberProperty(string stringPropertyName, VARIANT propertyValue);
            HRESULT PutSubscriberProperty(string stringPropertyName, object propertyValue);
            HRESULT RemoveSubscriberProperty(string stringPropertyName);
            //HRESULT GetSubscriberPropertyCollection(out IEventObjectCollection collection);
            HRESULT GetSubscriberPropertyCollection(out IntPtr collection);
            HRESULT get_InterfaceID(out string pstringInterfaceID);
            HRESULT put_InterfaceID(string stringInterfaceID);
        }
    
        [ComImport]
        [Guid("4E14FB9F-2E22-11D1-9964-00C04FBBB345")]
        [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
        public interface IEventSystem
        {
            #region <IDispatch>
            int GetTypeInfoCount();
            [return: MarshalAs(UnmanagedType.Interface)]
            IntPtr GetTypeInfo([In, MarshalAs(UnmanagedType.U4)] int iTInfo, [In, MarshalAs(UnmanagedType.U4)] int lcid);
            [PreserveSig]
            HRESULT GetIDsOfNames([In] ref Guid riid, [In, MarshalAs(UnmanagedType.LPArray)] string[] rgszNames, [In, MarshalAs(UnmanagedType.U4)] int cNames,
                [In, MarshalAs(UnmanagedType.U4)] int lcid, [Out, MarshalAs(UnmanagedType.LPArray)] int[] rgDispId);
            [PreserveSig]
            HRESULT Invoke(int dispIdMember, [In] ref Guid riid, [In, MarshalAs(UnmanagedType.U4)] int lcid, [In, MarshalAs(UnmanagedType.U4)] int dwFlags,
                [Out, In] System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, [Out] out object pVarResult, [Out, In] System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, [Out, MarshalAs(UnmanagedType.LPArray)] IntPtr[] pArgErr);
            #endregion
    
            [PreserveSig]
            HRESULT Query(string progID, string queryCriteria, out int errorIndex, out IntPtr ppInterface);
            [PreserveSig]
            HRESULT Store(string ProgID, IntPtr pInterface);
            [PreserveSig]
            HRESULT Remove(string progID, string queryCriteria, out int errorIndex);
            [PreserveSig]
            HRESULT get_EventObjectChangeEventClassID(out string pbstrEventClassID);
            [PreserveSig]
            HRESULT QueryS(string progID, string queryCriteria, out IntPtr ppInterface);
            [PreserveSig]
            HRESULT RemoveS(string progID, string queryCriteria);
        }
    
        public class CSensEvent : ISensLogon
        {
            IEventSystem m_pEventSystem = null;
            
            int ISensLogon.GetTypeInfoCount()
            {
                throw new NotImplementedException();
            }
    
            IntPtr ISensLogon.GetTypeInfo(int iTInfo, int lcid)
            {
                throw new NotImplementedException();
            }
    
            HRESULT ISensLogon.GetIDsOfNames(ref Guid riid, string[] rgszNames, int cNames, int lcid, int[] rgDispId)
            {
                throw new NotImplementedException();
            }
    
            HRESULT ISensLogon.Invoke(int dispIdMember, ref Guid riid, int lcid, int dwFlags, System.Runtime.InteropServices.ComTypes.DISPPARAMS pDispParams, out object pVarResult, System.Runtime.InteropServices.ComTypes.EXCEPINFO pExcepInfo, IntPtr[] pArgErr)
            {
                throw new NotImplementedException();
            }
    
            HRESULT ISensLogon.Logon(string stringUserName)
            {
                Console.Beep(1000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.Logoff(string stringUserName)
            {
                Console.Beep(2000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.StartShell(string stringUserName)
            {
                Console.Beep(8000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.DisplayLock(string stringUserName)
            {
                Console.Beep(5000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.DisplayUnlock(string stringUserName)
            {
                Console.Beep(6000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.StartScreenSaver(string stringUserName)
            {
                Console.Beep(3000, 10);
                return HRESULT.S_OK;
            }
    
            HRESULT ISensLogon.StopScreenSaver(string stringUserName)
            {
                Console.Beep(4000, 10);
                return HRESULT.S_OK;
            }
    
            public HRESULT Initialize()
            {
                HRESULT hr = HRESULT.E_FAIL;
                Guid CLSID_CEventSubscription = new Guid("7542e960-79c7-11d1-88f9-0080c7d771bf");
                Type EventSubscriptionType = Type.GetTypeFromCLSID(CLSID_CEventSubscription, true);
                object EventSubscription = Activator.CreateInstance(EventSubscriptionType);
                IEventSubscription pEventSubscription = (IEventSubscription)EventSubscription;
                if (pEventSubscription != null)
                {
                    hr = pEventSubscription.put_EventClassID("{D5978630-5B9F-11D1-8DD2-00AA004ABD5E}");
                    if (hr == HRESULT.S_OK)
                    {
                        hr = pEventSubscription.put_SubscriptionName("TestISensLogon");
                        if (hr == HRESULT.S_OK)
                        {
                            hr = pEventSubscription.put_PerUser(true);                            
                            if (hr == HRESULT.S_OK)
                            {
                                IntPtr pSubscriberInterface = Marshal.GetIUnknownForObject(this);
                                hr = pEventSubscription.put_SubscriberInterface(pSubscriberInterface);
                                Guid CLSID_CEventSystem = new Guid("4E14FBA2-2E22-11D1-9964-00C04FBBB345");
                                Type EventSystemType = Type.GetTypeFromCLSID(CLSID_CEventSystem, true);
                                object EventSystem = Activator.CreateInstance(EventSystemType);
                                m_pEventSystem = (IEventSystem)EventSystem;
                                IntPtr pInterface = Marshal.GetIUnknownForObject(pEventSubscription);
                                hr = m_pEventSystem.Store("EventSystem.EventSubscription", pInterface);
                            }
                        }
                    }
                    Marshal.ReleaseComObject(pEventSubscription);
                }
    
                return hr;
            }
    
            public HRESULT UnInitialize()
            {
                HRESULT hr = HRESULT.E_FAIL;
                if (m_pEventSystem != null)
                {
                    // System.UnauthorizedAccessException
                    // HResult = 0x80070005
                    // Message = Accès refusé. (Exception de HRESULT: 0x80070005(E_ACCESSDENIED))
     
                    int nErrorIndex = 0;
                    hr = m_pEventSystem.Remove("EventSystem.EventSubscription", "EventClassID={D5978630-5B9F-11D1-8DD2-00AA004ABD5E}", out nErrorIndex);
                    Marshal.ReleaseComObject(m_pEventSystem);
                }
                return hr;
            }
        }
    
        CSensEvent m_pSensEvent = null;
    
        public Form1()
        {
            InitializeComponent();
            this.FormClosed += new System.Windows.Forms.FormClosedEventHandler(this.Form1_FormClosed);
        }
    
        private void button1_Click(object sender, EventArgs e)
        {
            m_pSensEvent = new CSensEvent();
            m_pSensEvent.Initialize();
        }
    
        private void Form1_FormClosed(object sender, FormClosedEventArgs e)
        {
            if (m_pSensEvent != null)
            {
                m_pSensEvent.UnInitialize();
            }
        }
    }
    
    
    0 comments No comments