Home / server / Questions / 36223
In Process
Mike McClelland
Asked: 2009-07-06 23:56:24 +0800 CST

Querying a Windows box to see if the currently logged on user is idle - ideally using WMI

  • 772

I want to be able to query whether the currently logged in user is idle at their PC - i.e. their PC believes they are 'inactive'... The problem is there are so many ways this could be done. Is there a universal: "THIS COMPUTER IS IDLE/INACTIVE" - I'm thinking about using whatever measure the power subsystem uses...

My thought is to use WMI/Powershell but I could also use a .NET call in C# - I'd just rather not!

Sorry to be a bit vague on this and I'm more than happy for anybody to edit my question into something more meaningful!

Mike

windows login powershell wmi electrical-power

2 Answers

  1. If you're willing to hack it and look for a screensaver to detmine inactivity you might as well use powershell to see if the session is inactive (i.e. the computer is locked):

    QUERY SESSION /server:MachineName UserName

    it uses the terminal services interface to see if a user is attached to a session. This works because in modern versions of windows all local users are treated as being console sessions of the computer. The two status of interest are:

    • Active: Logged in and using
    • Disconnected: logged in but the screen is locked or user is detached

    As it's based on the old qwinsta functionality rather than being fully OO you'll need to do some string manipulation if you want a boolean out of it (i.e. -contains "Active").

    For an accurate figure (and what screensavers themselves are generally driven by) look at the LastInputInfo() win32 API call but you need to run it in the user's context which is usually a deal breaker if you need remote monitoring. Here's the MSDN article though: http://msdn.microsoft.com/en-us/library/ms646302(VS.85).aspx

    • 3

  2. No is the simple answer.

    I have in the past used WMI to list the running processes and looked for the screen saver. If the screen saver is running they are inactive in one sense, though you still can't tell if they've left an app running. You can check things like CPU and/or disk actvity, but it's hard to get a firm answer from these.

    JR

    • 2