Click here to Skip to main content
15,877,384 members
Articles / Desktop Programming / WPF

Sessiontime - Record Windows Session and Locked/unlocked Events and Parse and Display Collected Data

Rate me:
Please Sign up or sign in to vote.
4.98/5 (14 votes)
31 Mar 2021MIT4 min read 37.9K   1K   40   13
Record various Windows session events, log them, parse and display session events per user
This application consists of Windows service that records Windows session events and WPF application that parses resulting data to display session durations and locked/unlocked periods within sessions for selected user.


This article describes one possible approach to recording session events on Windows operating system. It also parses event data to display session durations and locked/unlocked periods. The following session events are recorded: logon, logoff, lock, unlock.

The source code might be useful to developers who need working source code to help them with their own Windows session time solution. Windows service and application might be useful if you want to monitor how much time you spend on the computer or at which time you logged in and started working.

The application consists of the following parts:

  • SessionTimeMonitor - Windows service that records events
  • SessionTimeViewer - Windows application that displays parsed session durations and locked/unlocked periods within sessions
  • SessionTimeCommon - Contains shared functionality used from SessionTimeMonitor and SessionTimeViewer
  • SessionTimeSetupWix - Installer/uninstaller for Windows service and application


Main part is a Windows service called SessionTimeMonitor - it handles the OnSessionChange event which is triggered each time a session change occurs. When event is triggered, record is added by the service to the XML file on the disk. Record contains information about the event, such as datetime, type of event, etc.


SessionTimeViewer application opens and parses XML file that contains data records written by the SessionTimeMonitor. It displays list of sessions with their start and end datetime along with the locked/unlocked periods within a single session. SessionTimeViewer is implemented as a WPF application.


I needed this application to determine how much time I spend on the computer and I wanted to have a customizable application. An alternative approach was to write an application that parses Windows event logs but I concluded that parsing Windows event logs and pairing logon/logoff and lock/unlock events was quite cumbersome.

Development Tools

Initial version of Windows service and WPF application were developed using .NET Framework 4.0 and Visual Studio 2010. Current solution builds in Visual Studio 2017 with WiX support and .NET Framework 4.0.

How It Works

The following illustration shows how this approach works:

SessionTimeMonitor (Windows service) -> writes to -> XML data file -> is read and parsed by -> SessionTimeViewer (Windows application)

Handling the OnSessionChange Event

The main part of the solution is a Windows service that records session events to the XML data file, this is done through overriding the OnSessionChange event. Recorded data is kept in form of XML file stored on disk.

XML Data Record

Each recorded event is represented by SessionTrackingParams XML element. Such element is added to XML file when the service starts (OnStart event) for each existing session or when session changes (OnSessionChange event). Such events are recorded by SessionTimeMonitor service and added to XML file.

Displaying Session Duration and Locked/unlocked Periods

Parsing of XML file is performed by SessionTimeViewer which is a Windows WPF application that shows following information:

  • sessions - as periods between logon and logoff event within same service run marked by ServiceRunGuid
  • unlocked periods - as periods within same session between: logon and logoff, logon and lock, unlock and logoff, unlock and lock
  • locked periods - as periods within same session between: lock and unlock, lock and logoff

This way, it is possible to see when and for how long user's session lasted and when locked and unlocked periods happened.

Points of Interest

  • On some systems, it might be necessary that SessionTime is installed by user with Administrator privilege, it might also be necessary that SessionTimeViewer is run by user with Administrator privilege.
  • SessionTimeMonitor utilizes the Cassia library which is "a .NET library for accessing the native Windows Terminal Services API (now the Remote Desktop Services API)" (, 2016-01-06), it uses its GetSessions method to obtain session data.
  • When computer starts up, it is possible that SessionTimeMonitor: starts before user logon - in such case, user logon will be recorded through OnSessionChange event, starts after user logon - in such case, all existing sessions are recorded through service's OnStart event.
  • Service and application have been tested on Windows 7 (32 bit), Windows 8.1 (64 bit), Windows 10 (64-bit)
  • The application requires currently used .NET Framework runtime to be installed on the computer.


  • - 2016-06-01 - Initial version
  • - 2016-06-01 - Bugfix for version, previous version wasn't logging logoff event correctly due to last-minute untested change
  • – Various bugfixes, user selection, Wix setup introduced
  • – Various improvements: added "About" window with version/author/repository/documentation info, replaced .docx with .txt for documentation file, improved quality of documentation, moved error log to folder Environment.SpecialFolder.LocalApplicationData, added application icon, global variable moved to GlobalSettings class, removed deprecated SessionTimeSetup project.
  • – Renaming in UI to improve correctness and consistency of terms used in application and documentation, showing of exception in message to the user, displaying of versions of all three components in "About" window.


This article, along with any associated source code and files, is licensed under The MIT License

Written By
Croatia Croatia
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions

SuggestionExport... Pin
dandy7230-Aug-19 3:32
dandy7230-Aug-19 3:32 
PraiseRe: Export... Pin
Ivan Golović14-Nov-19 1:44
Ivan Golović14-Nov-19 1:44 
Questionwhat kind of permission to deploy your app? Pin
Southmountain24-Aug-19 9:31
Southmountain24-Aug-19 9:31 
AnswerRe: what kind of permission to deploy your app? Pin
Ivan Golović14-Nov-19 1:57
Ivan Golović14-Nov-19 1:57 
Suggestionremote and console events Pin
Member 1001444120-Aug-19 1:46
Member 1001444120-Aug-19 1:46 
GeneralRe: remote and console events Pin
KarlSalisbury20-Aug-19 4:29
KarlSalisbury20-Aug-19 4:29 
GeneralRe: remote and console events Pin
Ivan Golović14-Nov-19 1:42
Ivan Golović14-Nov-19 1:42 
GeneralMy vote of 4 Pin
Member 1453411719-Aug-19 20:34
Member 1453411719-Aug-19 20:34 
GeneralMy vote of 5 Pin
Member 1453411719-Aug-19 20:34
Member 1453411719-Aug-19 20:34 
GeneralRe: My vote of 5 Pin
Ivan Golović14-Nov-19 1:58
Ivan Golović14-Nov-19 1:58 
QuestionEasier Log viewing? Pin
John Torjo6-Jan-16 1:03
professionalJohn Torjo6-Jan-16 1:03 
AnswerRe: Easier Log viewing? Pin
Ivan Golović6-Jan-16 1:20
Ivan Golović6-Jan-16 1:20 
GeneralRe: Easier Log viewing? Pin
John Torjo6-Jan-16 1:29
professionalJohn Torjo6-Jan-16 1:29 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.