Good link...What I am trying to do is slightly different though. In the post, the event sink is the .NET application it self. In my case, the event sink is another COM object and this sink COM object is instantiated from .NET application.
if you import you dll in .net application,you can assign the sink method to your interface directly
"Opinions are neither right nor wrong. I cannot change your opinion. I can, however, change what influences your opinion." - David Crow Never mind - my own stupidity is the source of every "problem" - Mixture
1. Enable Logon auditing in group policy.
2. Subscribe to that particular event using Event Log API's EvtSubscribe[^]
Your program would need to run as a service, because it's possible that noone is logged in at the very moment. I have to little detailed understandiong of the matter toto provide better help, btu that might get you started.