The Win32_LogonSession WMI class describes the logon session or sessions associated with a user logged on to a computer system running Windows NT or Windows 2000.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Properties and methods are in alphabetic order, not MOF order.

Syntax

class Win32_LogonSession : Win32_Session
{
  string   AuthenticationPackage;
  string   Caption;
  string   Description;
  datetime InstallDate;
  string   LogonId;
  uint32   LogonType;
  string   Name;
  datetime StartTime;
  string   Status;
};

Members

The Win32_LogonSession class defines the following members:

• Properties

Properties

The Win32_LogonSession class defines the following properties.

AuthenticationPackage

Data type: string

Access type: Read-only

Name of the subsystem used to authenticate the logon session. This property is inherited from Win32_LogonSession.

Caption

Data type: string

Access type: Read-only

Qualifiers: MaxLen (64)

String that represents the short description (one-line string) of the object. This property is inherited from CIM_ManagedSystemElement.

Description

Data type: string

Access type: Read/write

Textual description of the object. This property is inherited from CIM_ManagedSystemElement.

InstallDate

Data type: datetime

Access type: Read-only

Represents the date and time the object was installed. This property does not require a value to indicate that the object is installed. This property is inherited from CIM_ManagedSystemElement.

LogonId

Data type: string

Access type: Read-only

ID assigned to the logon session.

LogonType

Data type: uint32

Access type: Read-only

Numeric value that indicates the type of logon session.

Value	Meaning
0	Used only by the System account.
Interactive 2	Intended for users who are interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process.
Network 3	Intended for high-performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type.
Batch 4	Intended for batch servers, where processes can be executed on behalf of a user without their direct intervention; or for higher performance servers that process many clear-text authentication attempts at a time, such as mail or Web servers. LogonUser does not cache credentials for this logon type.
Service 5	Indicates a service-type logon. The account provided must have the service privilege enabled.
Proxy 6	Indicates a proxy-type logon.
Unlock 7	This logon type is intended for GINA DLLs logging on users who are interactively using the machine. This logon type allows a unique audit record to be generated that shows when the workstation was unlocked.
NetworkCleartext 8	Windows Server 2003, Windows 2000, and Windows XP:  Preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers.
NewCredentials 9	Windows Server 2003, Windows 2000, and Windows XP:  Allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections.
RemoteInteractive 10	Terminal Services session that is both remote and interactive.
CachedInteractive 11	Attempt cached credentials without accessing the network.
CachedRemoteInteractive 12	Same as RemoteInteractive. This is used for internal auditing.
CachedUnlock 13	Workstation logon.

 

Name

Data type: string

Access type: Read-only

Defines the label by which the object is known. This property is inherited from CIM_ManagedSystemElement.

StartTime

Data type: datetime

Access type: Read-only

The time at which the session started. This property is inherited from Win32_Session.

Status

Data type: string

Access type: Read-only

Current status of the object. Various operational and nonoperational statuses can be defined. Operational statuses include: "OK", "Degraded", and "Pred Fail" (an element, such as a SMART-enabled hard disk drive may function properly, but predicts a failure in the near future). Nonoperational statuses include: "Error", "Starting", "Stopping", and "Service". The Service status applies to administrative work, such as mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is online, but the managed element is neither "OK" nor in one of the other states.

The values are:

"OK"

"Error"

"Degraded"

"Unknown"

"Pred Fail"

"Starting"

"Stopping"

"Service"

Examples

For script code examples, see WMI Tasks for Scripts and Applications and the TechNet ScriptCenter Script Repository.

For C++ code examples, see WMI C++ Application Examples.

Requirements

See Also

Operating System Classes

Send comments about this topic to Microsoft

Build date: 1/8/2010

Build type: MSDN