Click here to Skip to main content
14,355,397 members

SessionTime - log Windows session events and display session durations and locked periods

Rate this:
4.97 (12 votes)
Please Sign up or sign in to vote.
4.97 (12 votes)
1 Sep 2019MIT
This application consists of Windows service that logs Windows session events and WPF application that parses resulting log to display session durations and locked/unlocked periods within sessions for selected user.


Source code


This article describes a possible approach to logging session events on Windows operating system. It also parses event data to display session durations and locked/unlocked periods. Following session events are logged: logon, logoff, lock, unlock.

Source code might be useful to developers who need working source code to help them with their own Windows session logging solution. Windows service and app might be useful if you, say, want to monitor how much time you spend on the computer or at which time you logged in and started working.

The application consists of three parts:

  • SessionTimeMonitor - Windows service that logs events
  • SessionTimeViewer - Windows application that displays parsed session durations and locked/unlocked periods within sessions
  • SessionTimeSetup - Installer/uninstaller for Windows service and application


Main part is a Windows service called SessionTimeMonitor - it handles the OnSessionChange event which is triggered each time when a session change occurs. When event is triggered, record is added by the service to the XML file on the disk. Record contains information about the event, such as datetime, type of event, etc.


SessionTimeViewer application opens and parses XML file that contains data records written by the SessionTimeMonitor. It displays list of sessions with their start and end datetime along with the locked/unlocked periods within a single session. SessionTimeViewer is implemented as a WPF application.


I needed this application to determine how much time I spend on the computer and I wanted to have a customizable application. An alternative approach was to write an application that parses Windows event logs but I concluded that parsing Windows event logs and pairing logon/logoff and lock/unlock events was quite cumbersome.

Using the Code

Development Tools

Initial version of Windows service and WPF application were developed using .NET Framework 4.0 and Visual Studio 2010.

How It Works

The following illustration shows how this approach works:

SessionTimeMonitor (Windows service)

-> writes to - >

XML data file

-> is read and parsed by - >

SessionTimeViewer (Windows application)

Handling the OnSessionChange Event

The main part of the solution is a Windows service that logs session events to the XML data file, this is done through overriding the OnSessionChange event.

Log is kept in the form of XML file stored on disk.

XML Data Record

Each logged event is represented by SessionTrackingParams XML element. Such element is added to log when the service starts (during the service's OnStart event) for each existing session or when session changes (when OnSessionChange event occurs) only for session that changed. Such events are logged in SessionTimeMonitor service and serialized to the list stored in XML data file.

Displaying Session Duration and Locked/Unlocked Periods

Parsing of XML data file is performed by SessionTimeViewer which is a Windows WPF application that shows following types of data:

  • sessions - as periods between logon and logoff event within same service run marked by ServiceRunGuid
  • unlocked periods - as periods within same session between:
    • logon and logoff
    • logon and lock
    • unlock and logoff
    • unlock and lock
  • locked periods - as periods within same session between:
    • lock and unlock
    • lock and logoff

This way, it is possible to see when and how long certain user has been logged on and when locked or unlocked periods happened.

Points of Interest

  • SessionTimeMonitor utilizes the Cassia library which is "a .NET library for accessing the native Windows Terminal Services API (now the Remote Desktop Services API)" (, 2016-01-06), it uses its GetSessions method to obtain session data
  • SessionTimeViewer displays only session for which the logoff event exists, this means that current session along with its locked/unlocked periods is not displayed until logoff
  • When computer starts up, it is possible that SessionTimeMonitor:
    • starts before user logon - in such case, user logon will be logged through OnSessionChange event
    • starts after the user logon - in such case, all existing sessions are logged through service's OnStart event
  • SessionTimeMonitor and SessionTimeViewer are using config files to set path of XML data file, so those paths are configurable
  • Service and application have been tested on Windows 7 (32 bit), Windows 8.1 (64 bit), Windows 10 (64-bit)
  • For initial version of application prerequisite on client computer is .NET Framework 4.0


  • - 2016-06-01 - Initial version
  • - 2016-06-01 - Bugfix for version, previous version wasn't logging logoff event correctly due to last-minute untested change, sorry to all the folks who downloaded version
  • – various bugfixes, migration to Visual Studio 2019, GitHub, Wix setup introduced


This article, along with any associated source code and files, is licensed under The MIT License


About the Author

Ivan Golović
Croatia Croatia
No Biography provided

Comments and Discussions

SuggestionExport... Pin
dandy7230-Aug-19 4:32
memberdandy7230-Aug-19 4:32 
Questionwhat kind of permission to deploy your app? Pin
Southmountain24-Aug-19 10:31
memberSouthmountain24-Aug-19 10:31 
Suggestionremote and console events Pin
Member 1001444120-Aug-19 2:46
memberMember 1001444120-Aug-19 2:46 
GeneralRe: remote and console events Pin
KarlSalisbury20-Aug-19 5:29
memberKarlSalisbury20-Aug-19 5:29 
GeneralMy vote of 4 Pin
Member 1453411719-Aug-19 21:34
memberMember 1453411719-Aug-19 21:34 
GeneralMy vote of 5 Pin
Member 1453411719-Aug-19 21:34
memberMember 1453411719-Aug-19 21:34 
QuestionEasier Log viewing? Pin
John Torjo6-Jan-16 2:03
professionalJohn Torjo6-Jan-16 2:03 
AnswerRe: Easier Log viewing? Pin
Ivan Golović6-Jan-16 2:20
memberIvan Golović6-Jan-16 2:20 
GeneralRe: Easier Log viewing? Pin
John Torjo6-Jan-16 2:29
professionalJohn Torjo6-Jan-16 2:29 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Posted 6 Jan 2016


35 bookmarked