Winlogon can inform your notification package of the following events:
| Event | Description |
| Lock | This event occurs when the user locks the workstation. |
| Logoff | This event occurs when a user logs off from the system. The Logoff event is performed synchronously, even if the notification package's registry settings indicate that it can handle events asynchronously. |
| Logon | This event occurs when a user logs on the system. Note that the Logon event occurs before the user's network connections are restored. If your event handler requires access to the user's network connections, it should handle the StartShell event instead of the Logon event. |
| Shutdown | This event occurs just before the system shuts down. |
| StartScreenSaver | This event occurs when the screen saver has started. Typically, this happens after a user has been inactive for a set period of time.
Functions handling this event should not display a user interface. StartScreenSaver event notification is intended for informational purposes only. |
| StartShell | This event occurs after the user has logged onto the system, network connections have been established, and the user-specified shell program (usually Windows Explorer) has been started. |
| Startup | This event occurs when the system is started or restarted. |
| StopScreenSaver | This event occurs when the screen saver has stopped. Typically this happens when there is keyboard or mouse activity.
Functions handling this event should not display a user interface. StopScreenSaver event notification is intended for informational purposes only. |
| Unlock | This event occurs when the user unlocks the workstation or when a system administrator overrides the lock and logs the user off. |
Send comments about this topic to Microsoft
Build date: 7/31/2008