khorev
Junior Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
denis255
Я события входа/выхода разбираю по типу, для этого в evente надо включить галку сохранять параметры. Тип logon параметр 4, номера у них от 0 до 12 помоему, соответствие на память не помню - завтра посмотрю, если надо или в MSDN найти можно. А с предыдущей проблемой попробую responce скрипты в дебагере прогнать м.б. что нибудь и нарисуется.
Добавлено:
denis255
Да в догонку, под рукой оказалось, в твоем случае это 10 и 12
The SECURITY_LOGON_TYPE enumeration indicates the type of logon requested by a logon process.
typedef enum _SECURITY_LOGON_TYPE
{
Interactive = 2,
NetworkNetwork,
BatchBatch,
ServiceService,
ProxyProxy,
Unlock,
NetworkCleartext,
NewCredentials,
RemoteInteractive,
CachedInteractive,
CachedRemoteInteractive,
CachedUnlockCachedUnlock
}SECURITY_LOGON_TYPE,
*PSECURITY_LOGON_TYPE;
Constants
Interactive
The security principal is logging on interactively.
Network
The security principal is logging using a network.
Batch
The logon is for a batch process.
Service
The logon is for a service account.
Proxy
Not supported.
Unlock
The logon is an attempt to unlock a workstation.
NetworkCleartext
The logon is a network logon with cleartext credentials.
NewCredentials
Allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identity but uses different credentials for other network connections.
RemoteInteractive
A terminal server session that is both remote and interactive.
CachedInteractive
Attempt to use the cached credentials without going out across the network.
CachedRemoteInteractive
Same as RemoteInteractive, except used internally for auditing purposes.
CachedUnlock
The logon is an attempt to unlock a workstation.
|
