{"id":103,"date":"2011-04-23T16:58:45","date_gmt":"2011-04-23T08:58:45","guid":{"rendered":"https:\/\/www.techcoil.com\/blog\/?p=103"},"modified":"2018-09-02T22:44:25","modified_gmt":"2018-09-02T14:44:25","slug":"how-to-retrieve-the-username-of-the-user-who-logged-onto-windows-from-windows-service","status":"publish","type":"post","link":"https:\/\/www.techcoil.com\/blog\/how-to-retrieve-the-username-of-the-user-who-logged-onto-windows-from-windows-service\/","title":{"rendered":"How to retrieve the username of the user who logged onto Windows from windows service"},"content":{"rendered":"

Recently, I have been tasked to write a .NET application that will prepare the operating system environment for a user who had logged on a Windows 7 machine. As a first step, the application should grab some settings from the network by providing the username of the user to a server application. The application will then prepare the operating system environment based on the settings received.<\/p>\n

Writing the application as a windows service is a favorable option. This is because a windows service application can be configured to run automatically and will run before any user logs into the operating system. Furthermore, a windows service can run as Local System<\/a><\/code>, which mean that it can execute most operating system facilities without facing permission issues.<\/p>\n

Detecting user login event<\/h3>\n

Detecting user login event from a windows service is easy. By overriding the OnSessionChange<\/code> method from the ServiceBase<\/a><\/code> class, we can detect when a user log onto windows.<\/p>\n

\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.ComponentModel;\r\nusing System.Data;\r\nusing System.Diagnostics;\r\nusing System.ServiceProcess;\r\nusing System.Text;\r\n\r\nnamespace MyWindowsService\r\n{\r\n    public partial class MyWindowsService : ServiceBase\r\n    {\r\n        public MyWindowsService()\r\n        {\r\n            \/\/ Generated by Visual Studios\r\n            InitializeComponent();\r\n\r\n            \/\/ This is needed for this window service to detect session changes\r\n           base.CanHandleSessionChangeEvent = true;\r\n        }\r\n\r\n        protected override void OnStart(string[] args)\r\n        {\r\n            \/\/ Code to execute when windows service starts\r\n        }\r\n\r\n        protected override void OnStop()\r\n        {\r\n            \/\/ Code to execute when windows service stops\r\n        }\r\n\r\n        protected override void OnSessionChange(SessionChangeDescription\r\n            changeDescription)\r\n        {\r\n            \/\/ Use a switch block to segment the actions to perform for\r\n            \/\/ different session changes\r\n            switch (changeDescription.Reason)\r\n            {\r\n                case SessionChangeReason.SessionLogon:\r\n                    \/\/ Retrieve the username of the user who had just logged on\r\n                    string username = Machine.getInstance().getUsername();\r\n                break;\r\n\r\n                case SessionChangeReason.SessionLogoff:\r\n                    \/\/ Could perform any restoration of the operating system\r\n                    \/\/ environment here.\r\n                break;\r\n\r\n                case SessionChangeReason.ConsoleLogon:\r\n                    \/\/ Triggered whenever a user logs in after\r\n                    \/\/ switching user accounts\r\n                    \/\/ Triggered once by the windows service\r\n                    \/\/ account whenever a user logs in\r\n                break;\r\n            }\r\n\r\n            \/\/ Inform the base class of the change as well\r\n            base.OnSessionChange(changeDescription);\r\n        }\r\n    }\r\n}\r\n<\/pre>\n
As long as the windows service is started automatically, the OnSessionChange<\/code> method block will be called whenever there are changes in the user session. This includes the case when a user logs on to windows, in which Machine.getInstance().getUsername()<\/code> will be called. Note that besides log on and log off events, there are several other events defined in the SessionChangeReason<\/a><\/code> enumeration that you can handle from your windows service.<\/p>\n
Attempts made to retrieve the username<\/h3>\n
It makes sense for me to implement the Machine<\/code> class as a Singleton<\/a>. Machine.getInstance()<\/code> will return me the Machine<\/code> Singleton. The getUsername<\/code> instance method will return the username of the user who is currently logged on to windows.<\/p>\n
Environment.UserName and WindowsIdentity.GetCurrent().Name does not work<\/h4>\n
My first intuition to implementing the getUsername()<\/code> method is to utilitise facilities from the .NET framework, namely the UserName<\/code> property from the Environment<\/code><\/a> class or the  Name<\/code> property of the WindowsIdentity<\/code><\/a> class.  However, since the windows service is running as Local System<\/a><\/code> , which belongs to a separate environment from the logged on user, the string \"SYSTEM\" was returned instead.<\/p>\n
Looking for the right username with WMI<\/h4>\n
Windows Management Instrumentation<\/a> (WMI) was my next hope. A couple of google searches brought me two methods for retrieving the right username.<\/p>\n
Using the Win32_Process WMI class<\/h4>\n
The first method utilises the Win32_Process WMI class to inspect the owners of the explorer.exe process. Although I could get the list of usernames who are logged onto the machine, I felt that too much work is required to get the user who is currently active.<\/p>\n
\r\nManagementScope ms = new ManagementScope("\\\\\\\\.\\\\root\\\\cimv2");\r\nObjectQuery query = new ObjectQuery\r\n    ("select * from Win32_Process where name = 'explorer.exe'");\r\nManagementObjectSearcher searcher = new ManagementObjectSearcher(ms, query);\r\nManagementObjectCollection returnCollection = searcher.Get();\r\n\r\nforeach (ManagementObject mo in returnCollection)\r\n{\r\n    string[] argList = new string[] { string.Empty };\r\n    int returnVal = Convert.ToInt32( mo.InvokeMethod("GetOwner", argList));\r\n    if (returnVal == 0)\r\n    {\r\n        Console.WriteLine("User name:");\r\n        Console.WriteLine(argList[0].ToString());\r\n    }\r\n}\r\n<\/pre>\n
Using the Win32_ComputerSystem WMI class<\/h4>\n
The second method utilises the Win32_ComputerSystem WMI class:<\/p>\n
\r\nManagementScope ms = new ManagementScope("\\\\\\\\.\\\\root\\\\cimv2");\r\nObjectQuery query = new ObjectQuery("SELECT * FROM Win32_ComputerSystem");\r\nManagementObjectSearcher searcher = new ManagementObjectSearcher(ms, query);\r\nforeach(ManagementObject mo in searcher.Get())\r\n{\r\n    Console.WriteLine(mo["UserName"].ToString());\r\n}\r\n<\/pre>\n
This method is much better than the previous one in that there is only at most one instance of the Win32_ComputerSystem<\/code> WMI class. Whenever a user logged onto windows, the Username<\/code> attribute will contain the username of the user. In the case when there are no users in the windows system, there will be no instances of the Win32_ComputerSystem<\/code> class. These properties make Win32_ComputerSystem<\/code> my ideal choice in implementing the getUsername<\/code> method for my Machine<\/code> class.<\/p>\n
Implementing the Machine class<\/h3>\n
\r\npublic class Machine\r\n{\r\n    private static Object _classLocker = new Object();\r\n    private static Machine _machine; \r\n\r\n    private Machine()\r\n    {\r\n    } \/\/ end private Machine()\r\n\r\n    public static Machine getInstance()\r\n    {\r\n        if (_machine == null)\r\n        {\r\n            lock (_classLocker)\r\n            {\r\n                if (_machine == null)\r\n                {\r\n                    _machine = new Machine();\r\n                }\r\n            }\r\n        }\r\n        return _machine;\r\n    } \/\/ end public static Machine getInstance()\r\n\r\n    public String getUsername()\r\n    {\r\n        string username = null;\r\n        try\r\n        {\r\n            \/\/ Define WMI scope to look for the Win32_ComputerSystem object\r\n            ManagementScope ms = new ManagementScope("\\\\\\\\.\\\\root\\\\cimv2");\r\n            ms.Connect();\r\n\r\n            ObjectQuery query = new ObjectQuery\r\n                    ("SELECT * FROM Win32_ComputerSystem");\r\n            ManagementObjectSearcher searcher =\r\n                    new ManagementObjectSearcher(ms, query);\r\n\r\n            \/\/ This loop will only run at most once.\r\n            foreach (ManagementObject mo in searcher.Get())\r\n            {\r\n                \/\/ Extract the username\r\n                username = mo["UserName"].ToString();\r\n            }\r\n            \/\/ Remove the domain part from the username\r\n            string[] usernameParts = username.Split('\\\\');\r\n            \/\/ The username is contained in the last string portion.\r\n            username = usernameParts[usernameParts.Length - 1];\r\n        }\r\n        catch (Exception)\r\n        {\r\n            \/\/ The system currently has no users who are logged on\r\n            \/\/ Set the username to "SYSTEM" to denote that\r\n            username = "SYSTEM";\r\n        }\r\n        return username;\r\n    } \/\/ end String getUsername()\r\n} \/\/ end class Machine\r\n<\/pre>\n
Some posts that may interest you<\/h3>\n