Winlogon Notification Packages.
Results 1 to 8 of 8

Thread: Winlogon Notification Packages.

  1. #1

    Winlogon Notification Packages.

    I need to write a DLL in the registry to audit when a system is locked and unlocked. I have the materials to do so. However, I was wondering if someone could help me.

    http://msdn.microsoft.com/library/de...ry_entries.asp

    Maybe a tutorial, or a sample so I can follow?
    Share on Google+

  2. #2
    Banned
    Join Date
    Aug 2002
    Posts
    35
    why would you need to do this. it sound like you are trying to find someone who will tell you how to compromise an unlocked comp.
    Share on Google+

  3. #3
    Yes, Havanger. The whole concept behind the security of knowing when a locked computer is accessed is so I can comprimise it. If you know anything about computers, you know people monitor computer logs from the time the log in to the time they log out, but if the computer is locked, you have no way of knowing when the computer was unlocked. We would like to know exactly when a computer locked and unlocked to know exactly who is using a computer and at what times are they accessing the computer. So if adjusting the audit logs to monitor when a computer is locked/unlocked is a way to compromise a computer you found me out.
    Share on Google+

  4. #4
    Senior Member
    Join Date
    Sep 2001
    Posts
    831
    Joey,

    When the PC is locked... Doesn't it use the current user's account / password to lock & unlock it?

    All you could really see from this exercise is when the PC was unlocked/locked, not who did it, because it will just show the account of the user who's session was locked...
    This audit really wouldn't help much, unless you suspect someone has the password for another account and is fiddling with the computer... coz then you could compare when they are away from their computer to when the system was unlocked...

    And Havanger... WTF are you smoking?!
    -Matty_Cross
    \"Isn\'t sanity just a one trick pony anyway? I mean, all you get is one trick. Rational Thinking.
    But when you\'re good and crazy, hehe, the skies the limit!!\"
    Share on Google+

  5. #5
    Yes, and I received a link from a member on AO that showed me what I need to do, but I don't want to bring down the test server. It involves writing a DLL, and has commands to audit = well view this for an idea http://msdn.microsoft.com/library/de...ry_entries.asp you can audit screen saver on & screen saver off, and lock on and unlock, and we would really like to audit these processes.

    Matty: they want to ensure no one is unlocking/accessing computers during overnight processing. Hense auditing the lock, also they want to audit how often a user is locking their computer during the day. So if I want to take off for the day, I could lock my computer and leave, well if my computer is locked for 6 hours out of the day, and unlocked for an hour before I leave, what was I doing for that six hours?
    Share on Google+

  6. #6
    Senior Member
    Join Date
    Sep 2001
    Posts
    831
    So if I want to take off for the day, I could lock my computer and leave, well if my computer is locked for 6 hours out of the day, and unlocked for an hour before I leave, what was I doing for that six hours?
    Same thing I was doing... Out the back having a smoke... :P

    Checking that people are actually working, and not slacking off would be a good use for this audit... although it kinda worries me... Please delete this thread before someone from my work's IT Department sees it and implements a similar thing...
    -Matty_Cross
    \"Isn\'t sanity just a one trick pony anyway? I mean, all you get is one trick. Rational Thinking.
    But when you\'re good and crazy, hehe, the skies the limit!!\"
    Share on Google+

  7. #7
    I know this may be a process that JP will be looking into down the road, I'm sure it will be in the guidelines for anyone that has systems or areas doing closed system processes. I heard through the grape vine that it will be implemented on government own systems and systems running government funded processes, and we are usually one of the first companies to test drive these processes.
    Share on Google+

  8. #8
    Member
    Join Date
    Apr 2002
    Posts
    45

    Re: Winlogon Notification Packages.

    Originally posted here by JoeyBatch
    I need to write a DLL in the registry to audit when a system is locked and unlocked. I have the materials to do so. However, I was wondering if someone could help me.

    http://msdn.microsoft.com/library/de...ry_entries.asp

    Maybe a tutorial, or a sample so I can follow?
    NT 4 or Win2K ?
    Share on Google+

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •