Win2K Registry Edit.

Under Win2K you should be able to create a notification package registry key as a subkey of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify.

In the notify key you should be able to create a rule: lock with the registry values [REG_SZ]. However once I create this I need more information on creating an even handler fuction for this package. Is anyone familiar with this process.

This registry edit should allow the logging/auditing of the locking and unlocking of a system.

However, I need some assistance with completing this task.

I dont know if you have tried this yet but if you go to msdn on Microdoft and search for winlogon I got a LOT of hits.

http://www.microsoft.com/msdn

Yes, I have found a lot of information there...

I am not positive if this is what you want but in the registry API if you open the hkey using the RegOpenKeyEx (for win32 apps) or RegOpenKey then you can use the RegNotifyChangeKeyValue if you want to see if this value has changed. If it returns true then you can pop up an notification to your screen. Put this in a timed loop or whatever to check this value.

The API's are

Long RegOpenKeyEx (HKEY hkey, LPCTSTR 1pSubKey <address of the string containing the subkeys name to open under hkey>, DWORD u1Options <Must be 0>, samDesired <Security for this key>, phkResult <address of the buffer for the new handle>)

Long RegNotifyKeyValue (HKEY hkey, BOOL bWatchSubtree <reports changes to subkey if TRUE>, DWORD dwNotifyFilter <specifies flags>, HANDLE hevent <specifies event to raise if fAsynchronous is true>, BOOL fAsynchronous <changes are reported by signalling hevent if true>)

This information was obtained out of "Windows 95 and NT 4.0 registry and customization Handbook by Jerry Honeycutt"

I am not sure this is what you were asking but if not maybe you can clarify for me what sort of event handler you were wanting.

Well, from what I've understood from what you've written, your looking for help on writing the event handler.

I found this ... hopefully it will help... Its got the registry entries that you have to point to in the first link *I think you already linked to that one*, and in the second link, it has the Event Handler Function prototype.. That will give you some sample code...

Also, try this one