Who Connects to Your Computer?
Who connects to your computer?
Who connects to your computer? You can be notified by an MSN-like popup window while doing your work. The program can also create its own log file for all historical logon events. The log file created in the sample code is called called evlogger.txt and can be found in the application (evNotify.exe) folder.
The idea to write this code came from Tom Archer's article:
Monitoring the Windows Event Log
Before running the program please check if you have switched on "Audit logon events":
Note: Your account should have privileges to manipulate "Local Security Policy."
EvNotify monitors Windows security log for the following logon events:
You can refer to the link bellow for more detailed information:
Program's popup window displays the following information:
Note: You could test the program by logging as another user for example:
In FormMaim.cs are instantiated the following important classes:
1. EventListener:
This option creates events of the log-on/log-off category in the Windows security log upon every user's attempt to onto or off of the system.
528 . Local logon account event.
540 . Network logon account event.
538 . Logoff event (local or network).
529 . Logon failure event (local or network).
539 . Account locked out.
535 . The specified account's password has expired.
531 . Account currently disabled.
Log-on type codes revealed
User
Computer
Description - User
Description - Domain
Description - Logon type
Description - Workstation Name
Logon events are written in black.
Logoff events are written in blue.
Unsuccessful logon event are written in red.
runas /u:testuser cmd
Source code notes
2. SinkClass:
3. MSNPopup:
Finally I'd like to mention that this is not the most precise way of getting all event notifications. You could miss some of them. A more professional approach would be to use good old VC++ development using native API calls.
