Use of the unlisted API to obtain Terminal session inactivity (idle time) and log in time (Logon hours)

use of the unlisted API to obtain Terminal session inactivity (idle time) and log in time (Logon hours)
Tuuzed (Aberdeen) Posted: March 3, 2008 23:12:38
Copyright notice: Can be reproduced arbitrarily, please be sure to use hyperlinks in the form of the original source of the article and the author's information and this statement.
http://www.cppblog.com/tuuzed/archive/2008/03/03/43631.html

Many people may know the NT system's query user command, which returns the "User name work stage name identification code status idle time login time".

Microsoft has given an important API for getting a terminal session (see Terminal Services API Functions ), the APIs related to getting the current Terminal session feature are: wtsenumeratesessions , wtsquerysessioninformation .

wtsenumeratesessions : As the name implies, lists all the sessions and returns a Wts_session_info Structure , the structure stores the sessionid,winstationname,state (including active, disconnected, and so on).

wtsquerysessioninformation : This is a little different from the API above, it can only query the details of the session through SessionID, for example, ClientName, clientdirectory, etc., which can be used to connect the terminal client tools. wtsenumeratesessions feature-rich.

FollowMSDNsaid,wtsquerysessioninformationYou can also get information such as Idletime, Logontime, incomingbytes, outgoingbytes, etc., but it is a pity that the "This value was not used." Must be used in Windows Server 2008 and Windows Vista SP1 use, the limitations are too great. Have to Goolge on their own search, in the foreign forum, most people to get idle time is said in WIN2008 or Vista support. So how does the query command in WIN2000 and 2003 get the login time? There must be nothing in the public API inside! Sure enough, I found Guy Teverovsky's blog, which gives the answer ("Querying TS session idle time with C #" translation:"use C # to get idle time for Terminal Services (Terminal services) sessions") and I expected the difference is good--the information required in Winsta.dll an open API functionwinstationqueryinformationwreturns the structure of the winstationqueryinformationw inside.

you want to use winstationqueryinformationw you must know two of these important parameters Winstationinformation (enumerated type) values and WINSTATIONINFORMATIONW structure contents. The above two values are defined in VS2005 (winternl.h):

typedef enum _WINSTATIONINFOCLASS{
Winstationinformation = 8
} Winstationinfoclass;

typedef struct _WINSTATIONINFORMATIONW{
BYTE reserved2[70];
ULONG LogonId;
BYTE reserved3[1140];
} winstationinformationw, * PWINSTATIONINFORMATIONW;

The first value is very clear, is 8. The latter structure, which retains a bit of 1140 bits, has too many unknown information. Fortunately the bull gave a C # definition, and I turned it into a C + + structure definition:

typedef struct _WINSTATIONQUERYINFORMATION
{
Char reserved1[72];
unsigned int SessionId;
Char reserved2[4];
FILETIME Connecttime;
FILETIME Disconnecttime;
FILETIME Lastinputtime;
FILETIME Logontime;
Char reserved3[1096];
FILETIME currenttime;
} winstationqueryinformation, *pwinstationqueryinformation;

After defining this structure, the work has been done. Here is the unlisted API function loaded into Winsta.dll, which, by the way, wraps:

BOOL WINAPI winstationqueryinformation (HANDLE hserver, DWORD SessionId, DWORD Infoclass, LPVOID Buffer, DWORD Bufferlengt H, Lpdword Count)
{
typedef BOOL (WINAPI *procptr) (HANDLE, DWORD, DWORD, LPVOID, DWORD, Lpdword);
static hmodule hmodule = NULL;
static PROCPTR proc = NULL;
hmodule = LoadLibrary ("Winsta.dll");
if (hmodule = = NULL)
{
return FALSE;
}

if (proc = = NULL)
{
proc = (procptr) GetProcAddress (hmodule, "winstationqueryinformationw");
}

if (proc = = NULL)
{
return FALSE;
}

return proc (Hserver, SessionId, Infoclass, Buffer, Bufferlength, Count);
}

This way, as long as directly call their own winstationqueryinformation to indirectly call the DLL inside the WINSTATIONQUERYINFORMATIONW can be. Login logon time is available directly, while idle time is obtained by referring to the status of the current session: If the session is disconnected (disconnected) state, idle time = current time-time off (idle = currenttime- Disconnecttime); If the session is active (alive) state, idle time = current time-Last input time (idle times = currenttime-lastinputtime).

Already made a demo to see:

This is a rookit tool that I do, including the management of the terminal session. after this programming, give me the deepest feeling is the foreign prawn problem solving methods and domestic we have a very big difference, they are good at solving problems from a multi-angle, solve problems alone after the summary, is the use of network resources rather than rely on network resources.

Use of the unlisted API to obtain Terminal session inactivity (idle time) and log in time (Logon hours)