C / C++ / MFC

#pragma comment(lib, "Secur32.lib")

#include <iostream>
#include <windows.h>
#include <ntsecapi.h>
INT main()
{
    DWORD lc = 0;
    DWORD status = 0;
    PLUID list = nullptr;

    LsaEnumerateLogonSessions(&lc, &list);
    for (DWORD i = 0; i < lc; i++)
    {
        PSECURITY_LOGON_SESSION_DATA pData;

        status = LsaGetLogonSessionData((PLUID)((INT_PTR)list + sizeof(LUID) * i), &pData);
        if (0 == status)
        {
            if (Interactive == pData->LogonType)
            {
                FILETIME ft;
                SYSTEMTIME st_utc, st_local;
                TIME_ZONE_INFORMATION tzi;

                ft.dwHighDateTime = pData->LogonTime.HighPart;
                ft.dwLowDateTime = pData->LogonTime.LowPart;

                GetTimeZoneInformation(&tzi);
                FileTimeToSystemTime(&ft, &st_utc);
                SystemTimeToTzSpecificLocalTime(&tzi, &st_utc, &st_local);

                wprintf(L"UserName: %s\n", pData->UserName.Buffer);
                wprintf(L"Last logon %s: %d/%d/%d-%d:%d:%d:%d\n", tzi.StandardName, st_local.wMonth, st_local.wDay, st_local.wYear, st_local.wHour, st_local.wMinute, st_local.wSecond, st_local.wMilliseconds);
            }

            LsaFreeReturnBuffer(pData);
        }
    }
}

//The registry 'Olson TZ structure' is partially documented here https://docs.microsoft.com/en-us/windows/win32/api/timezoneapi/ns-timezoneapi-time_zone_information  --David Delaune
typedef struct _REG_TZI_FORMAT
{
    LONG Bias;
    LONG StandardBias;
    LONG DaylightBias;
    SYSTEMTIME StandardDate;
    SYSTEMTIME DaylightDate;
} REG_TZI_FORMAT;

BOOL ConvertToTzSpecificTimeZone(const wchar_t time_zone[], TIME_ZONE_INFORMATION * tzi, const SYSTEMTIME * lpUniversalTime, const LPSYSTEMTIME lpLocalTime)
{
    HKEY k;
    DWORD size = 0;
    REG_TZI_FORMAT tzdb;
    BOOL bRet = FALSE;

    SecureZeroMemory(tzi, sizeof(tzi));
    
    LSTATUS status = RegOpenKeyW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones", &k);

    if (ERROR_SUCCESS == status)
    {
        size = sizeof(REG_TZI_FORMAT);
        status = RegGetValueW(k, time_zone, L"TZI", RRF_RT_REG_BINARY, 0, &tzdb, &size);
        if (ERROR_SUCCESS == status)
        {
            tzi->Bias = tzdb.Bias;
            tzi->DaylightBias = tzdb.DaylightBias;
            tzi->DaylightDate = tzdb.DaylightDate;
            tzi->StandardBias = tzdb.StandardBias;
            tzi->StandardDate = tzdb.StandardDate;

            wcscpy_s(tzi->StandardName, time_zone);

            bRet = SystemTimeToTzSpecificLocalTime(tzi, lpUniversalTime, lpLocalTime);
        }
        RegCloseKey(k);
    }
    return bRet;
}

if (ConvertToTzSpecificTimeZone(L"Tokyo Standard Time", &tzi, &st_utc, &st_local))
{
    wprintf(L"Last logon %s: %d/%d/%d-%d:%d:%d:%d\n", tzi.StandardName, st_local.wMonth, st_local.wDay, st_local.wYear, st_local.wHour, st_local.wMinute, st_local.wSecond, st_local.wMilliseconds);
}

Derell Licht wrote:

Is this intended to be a 64-bit-only operation??

Derell Licht wrote:

I searched through *all* .h and .hpp files in c:\mingw, and these functions were not declared anywhere...

hSecur32 = LoadLibraryW(L"secur32.dll");
if (hSecur32 != NULL)
   {
   pfLELS = (pfLsaEnumerateLogonSessions)GetProcAddress(hSecur32, "LsaEnumerateLogonSessions");
   if (pfLELS == NULL)
      {
      wprintf(L"Could not get address for LsaEnumerateLogonSessions() in secur32.dll\n");
      }

Derell Licht wrote:

That worked beautifully for me!!
And yes, your code *does* in fact return the login times that I was looking for; Thank You again!!

g++ -Wall -O2 -DSTAND_ALONE=1 login_lsa.cpp -o login_lsa.exe -lsecur32

MAHMOUD ALI Jun2021 wrote:

DO YOU KNOW ANSWER ??

Zouaoui Billel wrote:

but I am facing a problem