windows_service/user_tracker_service.cpp at master · Olster/windows_service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#include "user_tracker_service.h"

#include <WtsApi32.h>

#pragma comment(lib, "Wtsapi32.lib")

void UserTrackerService::OnStart(DWORD /*argc*/, TCHAR** /*argv[]*/) {
  m_logFile.close();

  // TODO(Olster): Read this path from registry of from command line arguments.
  // This doesn't create non-existent dirs.
  m_logFile.open(_T("D:\\userLog.log"));

  if (!m_logFile.is_open()) {
    WriteToEventLog(_T("Can't open log file"), EVENTLOG_ERROR_TYPE);
  }
}

void UserTrackerService::OnStop() {
  // Doesn't matter if it's open.
  m_logFile.close();
}

void UserTrackerService::OnSessionChange(DWORD evtType,
                                         WTSSESSION_NOTIFICATION* notification) {
  // Let's get user name and the action they did.
  TCHAR* buf = nullptr;
  DWORD size = 0;

  BOOL res = ::WTSQuerySessionInformation(nullptr, notification->dwSessionId,
                                          WTSUserName, &buf, &size);

  CString message;

  if (!res) {
    message = _T("Can't get user name ");
  } else {
    SYSTEMTIME sysTime = {0};
    ::GetSystemTime(&sysTime);

    message.Format(_T("%2d.%2d.%4d|%2d:%2d:%2d|User name: %s "),
                   sysTime.wDay, sysTime.wMonth, sysTime.wYear,
                   sysTime.wHour, sysTime.wMinute, sysTime.wSecond, buf);
  }

  ::WTSFreeMemory(buf);

  // Get the event type.
  switch (evtType) {
    case WTS_CONSOLE_CONNECT:
      message.Append(_T("connected."));
    break;

    case WTS_CONSOLE_DISCONNECT:
      message.Append(_T("disconnected."));
    break;

    case WTS_REMOTE_CONNECT:
      message.Append(_T("connected remotely."));
    break;

    case WTS_REMOTE_DISCONNECT:
      message.Append(_T("disconnected remotely."));
    break;

    case WTS_SESSION_LOGON:
      message.Append(_T("logged on."));
    break;

    case WTS_SESSION_LOGOFF:
      message.Append(_T("logged off."));
    break;

    case WTS_SESSION_LOCK:
      message.Append(_T("locked the PC."));
    break;

    case WTS_SESSION_UNLOCK:
      message.Append(_T("unlocked the PC."));
    break;

    // Didn't add WTS_SESSION_REMOTE_CONTROL handler.

    default:
      message.Append(_T("performed untracked operation."));
    break;
  }

  if (m_logFile.is_open()) {
    m_logFile << message.GetString() << std::endl;
  }
}