1

If I call the following API from a local service running on Windows 7:

WTS_SESSION_INFO* pWSI;
DWORD nCntWSI;
WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, NULL, 1, &pWSI, &nCntWSI);

and then go through all returned WTS_SESSION_INFO structs in pWSI and check WTS_CONNECTSTATE_CLASS State members, can someone explain what is the difference between WTSActive and WTSConnected?

the Tin Man
  • 158,662
  • 42
  • 215
  • 303
ahmd0
  • 16,633
  • 33
  • 137
  • 233
  • "Connected" doesn't necessarily imply that you've successfully logged in. "Active" does ;) http://msdn.microsoft.com/en-us/library/windows/desktop/aa383860%28v=vs.85%29.aspx – paulsm4 Aug 21 '12 at 22:56
  • Thanks. But what do you mean by -- "Connected" doesn't necessarily imply that you've successfully logged in? How can a user session be "half" logged in? Can you explain? – ahmd0 Aug 21 '12 at 23:04
  • 1
    The user has connected and has been presented with a login screen but hasn't completed it and been verified yet. He might be typing his password, for example. – Carey Gregory Aug 22 '12 at 00:17
  • @CareyGregory: Thanks. WTSActive is pretty straightforward. I'm trying to under WTSConnected. So, if I a user session state is reported as WTSConnected does it mean that the user hasn't logged in yet (and there's no user-mode processes running under that user's account)? Or, a user might have logged in before, locked the workstattion and hasn't logged in back yet? – ahmd0 Aug 22 '12 at 02:06
  • 2
    Locking the computer doesn't end your session. You remain logged in. So being connected but not active means there are no processes running under your account. – Carey Gregory Aug 22 '12 at 04:12
  • (Unless there is a service or application setup to login using your credentials, but that's kind of a different matter.) – Carey Gregory Aug 22 '12 at 04:19
  • @CareyGregory: Thank you for the explanation. Do you want to copy it as a separate answer and I'll mark it? – ahmd0 Aug 22 '12 at 05:45

1 Answers1

2

Connected means the user has connected and has been (or soon will be) presented with a login screen but hasn't completed it and been verified yet. He might be typing his password, for example.

If the user has locked the workstation, it's been locked by a screensaver, or he has switched to another user account, it doesn't end his session. The user remains logged in and his session would remain marked active. So being connected but not active means there are no processes running under that user's account. (The one caveat being there could be a service or other process running in a separate session under that user's credentials, but that's a different matter.)

Carey Gregory
  • 6,836
  • 2
  • 26
  • 47
  • WTSConnected is also received when the user disconnects from an RDP session. With disconnect I mean just closing the RDP client window. In that case the user doesn't logoff and this is something like locking the screen. – Bemipefe Sep 27 '19 at 09:48
  • If the OS is a Windows Server version the value retrieved is always WTSConnected. At least during an RDP session I don't think this is a reliable way to figure out if the user is still logged in. – Bemipefe Sep 27 '19 at 11:55
  • @Bemipefe The documentation states that WTSActive does indicate the user is logged in and that's been my experience using it. – Carey Gregory Sep 27 '19 at 14:35
  • does it works also during an RDP session ? I mean if you connect to a computer (this means you are performing a login) and then you run your program which makes use of this API does it work as expected ? – Bemipefe Oct 09 '19 at 09:46
  • @Bemipefe I believe it will, yes, but you should test it to be sure. – Carey Gregory Oct 09 '19 at 14:34