Determining how long a user logs into Windows

Question

In our product, it became necessary to determine how long the current user logged on to Windows (in particular, Vista). There seems to be no direct API function for this, and I could not find anything related to WMI (although I am not an expert with WMI, so I might have missed something).

Any ideas?

Answer 1

For people not familiar with WMI (like me), here are a few links:

• MSDN page on using WMI from different languages: http://msdn.microsoft.com/en-us/library/aa393964(VS.85).aspx
• link to Win32_Session: http://msdn.microsoft.com/en-us/library/aa394422(VS.85).aspx , but objects in Win32_session are of type Win32_LogonSession ( http://msdn.microsoft.com/en-us /library/aa394189(VS.85).aspx ), which has more interesting properties.
• WMI Explorer is a tool that you can use to easily run queries such as published by Michal.

And here is an example of a Win32_Session request from VBS:

strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2") Set sessions = objWMIService.ExecQuery _ ("select * from Win32_Session") For Each objSession in sessions Wscript.Echo objSession.StartTime Next 

It warns 6 sessions for my personal computer, perhaps you can filter by LogonType to show only real ("interactive") users. I could not see how you could select the "current user" session.

[edit] and here is the result from Google to your problem: http://forum.sysinternals.com/forum_posts.asp?TID=3755

Answer 2

In Powershell and WMI, the following single-line command will return a list of objects representing the user and the time at which they entered.

 Get-WmiObject win32_networkloginprofile | ? {$_.lastlogon -ne $null} | % {[PSCustomObject]@{User=$_.caption; LastLogon=[Management.ManagementDateTimeConverter]::ToDateTime($_.lastlogon)}} 

Explanation:

• Get list of registered users from WMI
• Filter out any non-interactive users (effectively removes NT AUTHORITY\SYSTEM )
• Converts user and login time to read.

Literature:

• WMI object to use: https://forum.sysinternals.com/topic3755.html
• Date / Time Formatting: https://blogs.msdn.microsoft.com/powershell/2009/08/12/get-systemuptime-and-working-with-the-wmi-date-format/

Answer 3

In WMI, do: "select * from Win32_Session" there you will get the value "StartTime".

Hope this helps.

Answer 4

Using WMI, Win32Session is a great start. In addition, it should be noted that if you are online, you can use Win32_NetworkLoginProfile to get all kinds of information.

 Set logins = objWMIService.ExecQuery _ ("select * from Win32_NetworkLoginProfile") For Each objSession in logins Wscript.Echo objSession.LastLogon Next 

Other bits of information that you can collect include the username, the last logout, as well as various materials related to the profile.