Winlogon Notification Events

Winlogon can inform your notification package of the following events.

Event	Description
Lock	This event occurs when the user locks the workstation.
Logoff	This event occurs when a user logs off from the system. The Logoff event is performed synchronously, even if the notification package's registry settings indicate that it can handle events asynchronously.
Logon	This event occurs when a user logs on the system. Note that the Logon event occurs before the user's network connections are restored. If your event handler requires access to the user's network connections, it should handle the StartShell event instead of the Logon event.
Shutdown	This event occurs just before the system shuts down.
SmartCardLogonNotify	This event occurs when a user logs on to the system with a smart card.
StartScreenSaver	This event occurs when the screen saver has started. Typically, this happens after a user has been inactive for a set period of time. Functions handling this event should not display a user interface. StartScreenSaver event notification is intended for informational purposes only.
StartShell	This event occurs after the user has logged onto the system, network connections have been established, and the user-specified shell program (usually Windows Explorer) has been started.
Startup	This event occurs when the system is started or restarted.
StopScreenSaver	This event occurs when the screen saver has stopped. Typically this happens when there is keyboard or mouse activity. Functions handling this event should not display a user interface. StopScreenSaver event notification is intended for informational purposes only.
Unlock	This event occurs when the user unlocks the workstation or when a system administrator overrides the lock and logs the user off.