0

I want to fetch WIndows Login/Logoff events through Java

System name
Username
Timestamp
Login/Logoff/Lock/Unlock

I already got the below event codes that windows genearte

4608  STARTUP
4609  SHUTDOWN
4624  LOGON
4634  LOGOFF
4800  WORKSTATION_LOCKED 
4801  WORKSTATION_UNLOCKED

WHich library should I use in order to track all these?

Ritesh
  • 27
  • 1
  • 10

1 Answers1

0

You need to use WMI in order to retrieve these events. In WMI you have to create a COM server that connects to the root\cimv2 namespace (which is basically the default OS namespace). Within that namespace you can use WQL queries (similar to SQL query syntax) in order to query for system events (such as User Login/Logoff etc...). There are different ways to achieve that:

For a local Java WMI Wrapper you could consider using jWMI (though I am not entirely sure if it is still up to date).

In the past I have used j-interop. Even though this library targets remote COM access to WMI, it could also be used to create a COM bridge from the java process to local WMI. j-interop didn't have any updates since 2013, so I am not entirely sure if the library is still supported... Just in case here is a post on how to use j-interop for remote bridges. In that post you will also find some example queries for event and performance counter retrievals. (Note: j-interop might require slight configurations to your windows machine due to security reasons - so if you want to write an easy portable application for end-users, then j-interop might not be the best choice...)

Another interesting lib for bridges might be JACOB (never used it before, but seems interesting). Like j-interop it uses JNI to make native calls to the COM libraries.

fishi0x01
  • 3,579
  • 21
  • 25
  • Thanks fishi, I am not an advanced programmer, but I will try to implement it the solution and will update shortly – Ritesh Jun 21 '15 at 08:06
  • AHK helped me, if in case any one is looking for the same here is the link http://www.autohotkey.com/board/topic/57452-recording-login-logoff-username-and-timestamp/ – Ritesh Jul 04 '15 at 16:41