Sign in to follow this  
Followers 0
cjconstantine

Logon Desktop Time

2 posts in this topic

I have tried searching with no luck, what I am trying to find is at what time does the CTRL-ALT-DEL screen appear for a user to log in. I don't need to interact with it in any way, just what time it popped up ... even if finding that time is after the user has logged in.

I'm trying to measure from the point Windows starts up to the point the logon screen appears, stop measuring, then start again from the time the user successfully logs in to the time a predetermined process starts.

Right now I'm using the time that the Secondary Logon service starts as the point where the logon screen is up, but I know that's not really accurate. Any ideas?

#include <Services.au3>
#include <Date.au3>
#include <EventLog.au3>

Global Const $wbemFlagReturnImmediately = 0x10
Global Const $wbemFlagForwardOnly = 0x20

$WINDOWS_START_TIME = _DateAdd('s', -1 * Int(_Date_Time_GetTickCount() / 1000), _NowCalc())
$SECLOGON_START_TIME = _Get_SecLogon()
$USER_START_TIME = _GetUserLogon()

MsgBox(0, 'Date/Time stamps', 'Windows Start                = ' & $WINDOWS_START_TIME & _
                        @CR & 'Secondary Logon Start  =  ' & $SECLOGON_START_TIME & _
                        @CR & 'User Logon Start            = ' & $USER_START_TIME & _
                        @CR & 'Process Startup             = ' & _NowCalc())


Func Main()
     ; Needed for Services.au3
EndFunc

Func _Get_SecLogon()
    $created = ''
    $query = _Service_QueryStatus('seclogon')

    $oWMIService = ObjGet('winmgmts:\\' & '.' & '\root\CIMV2')
    If IsObj($oWMIService) Then
        $colItems = $oWMIService.ExecQuery('SELECT * FROM Win32_Process Where ProcessId=' & $query[7] & ' ', 'WQL', $wbemFlagReturnImmediately + $wbemFlagForwardOnly)
        If IsObj($colItems) Then
            For $oItem In $colItems
                $created = $oItem.CreationDate
            Next
        EndIf
    EndIf

    Return StringMid($created, 1, 4) & '/' & StringMid($created, 5, 2) & '/' & StringMid($created, 7, 2) & ' ' & StringMid($created, 9, 2) & ':' & StringMid($created, 11, 2) & ':' & StringMid($created, 13, 2)
EndFunc


Func _GetUserLogon()
    $created = ''

    $hEventLog = _EventLog__Open('', 'Security')
    Do
        $log = _EventLog__Read($hEventLog, True, False)

        $date = StringSplit($log[2], '/')
        $date = $date[3] & '/' & $date[1] & '/' & $date[2]

        $time = StringSplit($log[3], ':')
        If StringRight($time[3], 2) = 'PM' Then $time[1] += 12
        $time[3] = StringTrimRight($time[3], 3)
        $time = $time[1] & ':' & $time[2] & ':' & $time[3]

        $log[2] = $date
        $log[3] = $time

        If $log[6] = 528 And $log[9] = 2 And $log[7] = 8 And $log[12] = @LogonDomain & '\' & @UserName Then
            $created = $log[2] & ' ' & $log[3]
        EndIf
    Until $log[2] & ' ' & $log[3] < $SECLOGON_START_TIME

    Return $created
EndFunc

Share this post


Link to post
Share on other sites



I don't think this can be done with AutoIt. From what I'm reading, your trying to see how long does it take Windows to simply load. The only way I can think of is doing it is

  • setting up Remote desktop connection
  • doing a reboot if the remote PC is on the wire
  • do a ping loop to see how long the reboot takes.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0