Registering every Windows login try

Question

I want to keep a log with the attempted log-in to a machine. The OS is Windows Embbeded Standard. Is it possible to make Windows execute an application or a script after every login attempt to enable me to save that information in my database?

EDIT:

Extract from Superuser:

"Here, you can set auditing to all types of events. I believe the one you want is "Audit logon events", Set it to Failure (or Success as well if you want). All events will now get sent to Event Viewer. ..."

Is it possible to access the Event Viewer info via WMI?

Answer 1

From a security viewpoint, I would assume this would not be possible. But it is possible to write your specialized GINA library which would replace the standard login system of Windows. This was done to support fingerprint readers and smart card readers, and many other alternative login methods.

But out of curiosity, what kind of problem are you trying to solve here? Windows already has plenty of build-in functionality which can be analysed by anyone who can log in.

---

Follow this link to see how it's done in Windows 2003. I've checked with Windows XP on a virtual machine and it works exactly the same there. So I assume it also works in embedded XP versions.

---

For reading the event log, this link from MSDN will be practical too. This will require .NET though, which is optional on Windows XP.

Answer 2

WMI might be a good place to start. You could use WMI (or another method) to query the security event log for sucessful/failed logon events, too.

http://www.computerperformance.co.uk/vbscript/wmi_event_log_administrator.htm