Track windows login event from c#?

Question

.NET

Hi all!
I am writing code that will hang as a service in the system and monitor user authorization. If the user is logged in and the user is not an admin, it will run a certain program and make sure it runs.
So the question is: how to track the moment of entry into the system?
Z. s. I am the admin. And my program needs rights not lower than admin rights (it edits the registry on the go). That's why I decided to write a program that will hang as a service and run my application with the right permissions when needed.

Answer 1

you can also register the desired program as a winlogon script in policies, this will affect all users, incl. on the new
ones Run->gpedit.msc -> Local Computer Policy -> User Configuration -> Windows Settings -> Scripts (Logon/Logoff
) ) and for example a winform application, but without the main window or starting with a window in the "hidden" state,
you can pull the service from the application, or you can immediately do what you planned without any services
ps - as an option, you can read the security log at some time interval and to parse login events,
you need to understand that in any case it is almost impossible to hide from the admin
for example, the AutoRuns tool will show a "foreign body" in the system with any method of auto start - the "autorun" menu, the registry - any branches, service, driver, scheduler, policy ... although I just looked and did not see it right off the bat ... checked - funny, just like AutoRuns does not show the policy ...
pps - well, it's not a fact that for this you need to invent a whole service,
then you can initially run the desired program as a service,
for example, there is a library to run to run a debugged c # console program as a service - https http://github.com/Topshelf/Topshelf
ppps - it's not entirely clear why to build a service - the target application cannot work in the background? (it could immediately be launched as a service, there are many ways, including for ready-made applications .. in most cases at least ...)
or does the application require interaction with the user?
you can simply create a batch file in autoload, to always run on behalf of a specific login - runas is at your service,
for example, you can run an IE instance on behalf of another account, and have cache and cookies of another account in it .. up to simultaneous login to the social network under different names ... under one of the current profile .. under another from the IE profile running on behalf of another Windows account
(I'm just trying to understand the range of problems, based on the experience of solving situations that are possibly similar ...
pppps - ... maybe you need to clarify - if the application is YOUR (in the source code) - well, in the end - make the application itself a service and run it on behalf of the system (for example) ... if it is interactive .. - yes, the same thing - any convenient autorun method, but on behalf of the required account ... by the way, including on behalf of the system too

Answer 2

You need to overload this method:
ServiceBase.OnSessionChange

Answer 3

Redo the entire architecture and change .NET to C++ for the system service. This is ideal.
And so, look for the text "winlogon hook". . This is if done seriously, reliably and so on.