Determine computer state - Loggied in and idle

[StumpedTechy]

I need to come up with a way to determine if a user is logged into a machine or not and if the user is logged into the machine how long the machine has been in an idle state.

We have a TON of users who leave their computers up 24/7 but we have to do maintenance on machines. On the same note these users won't call me back when I need to arrange for me to do maintenance.

My boss said anyone who is idle on their PC for a long period of time is safe to kick off but I don't see any way to validate the user has been idle and I don't want a he said/she said situation.

I want to query and find out if a user is currently logged in and if the user is logged in how long the machine has been inactive.

 

[dm4ever]

Are the PC's setup to have a screen saver after a period of inactivity? Perhaps monitor for the screen saver (logon.scr) to kick in.

--------------------------------------------------------------------------------
dm4ever
My philosophy: K.I.S.S - Keep It Simple Stupid

 

[StumpedTechy]

Yeah but thats too short of a time.... I need some kind of counter for idle or sometehing. Our Screensaver is set to 5 minutes so if a person just walks away to get a cup of coffee the screensaver is on. I am thinking about a 3+hour idle time is more what I am gunning for. This will take care of anyone who has a meeting and a lunch back to back.

 

[jfdabiri]

3+ hours for idle time is rather long. usually the screen saver/pc-lock kicks in after 30 minutes or so. i think dm's suggestions is probably the best one. you can do your updates during this "idle" time. if the user wants to log on, and your update is running, disable the logon until you're done. after your work is done, unlock the logon routine.

 

[StumpedTechy]

Disabling user accounts isn't an option as alot of users have multiple machines and me making a person 100% down when they could be 50% productive ins't going to be supported by my boss. 3+ hours is the timeframe I need to determine if a machine is idle... I simply can't be taking over a PC after only 5 minutes of inactivity I will be having a ton of users screaming at me as well as an unhappy boss. Anyone know of a way to determine this?

Maybe search the file system for last modified times and then report back the last one and then compare it to the current time?

Anything?

 

[dm4ever]

What if you stuck with the monitoring for the screen saver to kick in, look at its creation date, and compare it with the current date time to see if it was created 3 hours ago?

--------------------------------------------------------------------------------
dm4ever
My philosophy: K.I.S.S - Keep It Simple Stupid

 

[jfdabiri]

so, you're looking for machines that have been idle for 3 hours. you can look at the event logs (sys & app) for stopped time or something like that compared to now() time. or see if screensave is active or not(logon.scr).

 

[brockweaver]

Easiest way to reliably do it: hook into the LowLevelKeyboardHook and LowLevelMouseHook messages from your program. No matter which app has focus, your code will receive notifications that a key is being pressed or a mouse event occurs. Each time you receive the key or mouse message, reset the timer. If the timer ever expires, they haven't sent in any input for the duration of your timer, so you can assume they're not actively using it.

You can't do this in VBScript, but you can make a COM dll which you can call from VBScript. The following code MUST be in a .bas module though, which you can call from a COM class in the same dll...

Option Explicit

Private Const WH_KEYBOARD_LL = 13&
Private Const HC_ACTION = 0&

Private Type KBDLLHOOKSTRUCT
vkCode As Long
scanCode As Long
flags As Long
time As Long
dwExtraInfo As Long
End Type

Private m_hDllKbdHook As Long

Private Declare Sub keybd_event Lib "user32" (ByVal bVk As Byte, ByVal bScan As Byte, ByVal dwFlags As Long, ByVal dwExtraInfo As Long)
Private Declare Function SetWindowsHookEx Lib "user32" _
Alias "SetWindowsHookExA" _
(ByVal idHook As Long, _
ByVal lpfn As Long, _
ByVal hmod As Long, _
ByVal dwThreadId As Long) As Long

Private Declare Function UnhookWindowsHookEx Lib "user32" _
(ByVal hHook As Long) As Long

Private Declare Function CallNextHookEx Lib "user32" _
(ByVal hHook As Long, _
ByVal nCode As Long, _
ByVal wParam As Long, _
ByVal lParam As Long) As Long

Private Declare Sub CopyMemory Lib "kernel32" _
Alias "RtlMoveMemory" _
(pDest As Any, _
pSource As Any, _
ByVal cb As Long)






Public Function StartHook(frm As Form) As Boolean

If Not frm Is Nothing Then
'set and obtain the handle to the keyboard hook
m_hDllKbdHook = SetWindowsHookEx(WH_KEYBOARD_LL, _
AddressOf LowLevelKeyboardProc, _
App.hInstance, _
0&)

Set tgt = frm
End If

StartHook = m_hDllKbdHook <> 0

End Function

Public Function StopHook() As Boolean
If m_hDllKbdHook <> 0 Then
Call UnhookWindowsHookEx(m_hDllKbdHook)
End If
m_hDllKbdHook = 0
End Function


Public Function LowLevelKeyboardProc(ByVal nCode As Long, _
ByVal wParam As Long, _
ByVal lParam As Long) As Long


Static kbdllhs As KBDLLHOOKSTRUCT

'On receipt of the HC_ACTION code,
'wParam and lParam contain information
'about a keyboard message, and lParam
'holds the pointer to a KBDLLHOOKSTRUCT
'structure.
Call CopyMemory(kbdllhs, ByVal lParam, Len(kbdllhs))

If nCode = HC_ACTION Then
' reset your timer here
Else
LowLevelKeyboardProc = CallNextHookEx(m_hDllKbdHook, _
nCode, _
wParam, _
lParam)
End If




End Function

 

[StumpedTechy]

Sorry this project got waylayed a little bit - putting out other fires at work and all.

And I found the solution you alluded to -

http://www.microsoft.com/technet/scriptcenter/resources/qanda/aug05/hey0810.mspx

One question how do I compare this date/time output bottom code example and compare it with the current date to give the actual difference in time. I can live with it telling me the date/time of the activation of the Screensaver but I would rather have it say it started X days and X hours and x minutes ago.