Where can I find information about windows was in standby-mode

Question

I have a C# application to find the "start working" and "finish working" events for a user. The goal is to get a list with datetime values, when a PC was "up" and when it is "down" again.

This is working for logon/logoff and hibernation but not for standby (save energy). Searching with eventvwr I could not find the correct events connected to "enter standby" and "wake up from standby".

With this I read from the windows event logs:

public SortedDictionary<string, UserProfileEvent> ReadUserProfileEvents() {
    string queryString = string.Format("*[System[TimeCreated[@SystemTime>='{0}' and @SystemTime<='{1}']]]", this.StartDate.ToString("s"), this.EndDate.ToString("s"));
    var q = new EventLogQuery("Microsoft-Windows-User Profile Service/Operational", PathType.LogName, queryString);
    var r = new EventLogReader(q);

    var liste = new SortedDictionary<string, UserProfileEvent>();

    EventRecord e = r.ReadEvent();
    UserProfileEvent upe = null;
    while (e != null) {
        upe = new UserProfileEvent(e);
        try {
            liste.Add(upe.SortKey, upe);
        }
        catch (Exception exp) {
            throw new Exception("Some error text", exp);
        }
        e = r.ReadEvent();
    }
    return liste;
}

Any ideas where to find the correct events?

EDIT: I just found "Microsoft-Windows-Power-Troubleshooter" and "Microsoft-Windows-Kernel-Power". These protocolls seem to point in the right directions...

score 2 · Accepted Answer · answered Nov 02 '15 at 11:24

Not everything will be listed in the event logs, cause they are not that important that a write to a log (on disk) would be required (by default).

If your application could run in background you could subscribe to some of those events and react accordingly. As "C Sharper" already wrote you can find them in the SystemEvents class.

Going to stand by (Session ending - Occurs when the user is trying to log off or shut down the system.)
User locks the screen (Session switch - Occurs when the currently logged-in user has changed)

score 1 · Answer 2 · answered Nov 02 '15 at 11:13

If this is a windows forms application you could use the SystemEvents class.

using System;
using Microsoft.Win32;

public sealed class App 
{
    static void Main() 
    {         
        // Set the SystemEvents class to receive event notification when a user 
        // preference changes, the palette changes, or when display settings change.
        SystemEvents.SessionEnding+= SystemEvents_SessionEnding;

        Console.WriteLine("This application is waiting for system events.");
        Console.WriteLine("Press <Enter> to terminate this application.");
        Console.ReadLine();
    }

    // This method is called when a user preference changes.
    static void SystemEvents_SessionEnding(object sender, SessionEndingEventArgs e) 
    {
       e.Category);
    }

}

But I do not want to react on an event, I want to get a list of "start being active" and "end being active" for several weeks in the past. — Shnugo, Nov 02 '15 at 11:15

Where can I find information about windows was in standby-mode

2 Answers2