Finding System Wide Idle Time

Hi,

I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.

One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.

If anyone has a better idea please share.

Thanks
RR

Why? Do you want to run a task when the machine is idle?

d

dent from a phpne with no keynoard

-----Original Message-----
From: xxxxx@shaw.ca
Sent: October 29, 2010 5:32 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Finding System Wide Idle Time

Hi,

I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.

One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.

If anyone has a better idea please share.

Thanks
RR


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

If nobody is logged in who is using the keyboard?

Mark Roddy

On Fri, Oct 29, 2010 at 8:32 PM, wrote:
> Hi,
>
> I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.
>
> One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.
>
> If anyone has a better idea please share.
>
> Thanks
> RR
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

Define idle?

You can have noone logged on machine, but yet, it is not idle, because some
services (user mode or kernel mode) are doing something. The best idea which
comes into my mind is using perf counters to track activity of Idle process
or Process class.

You can perform this from NT service and thus handle cases when noone is
logged on. But with perf counters one has to suffer with localization (it is
doable, just annoying). In NT service I guess you can also track session
changes and see when someone is trying to logon, and thus system because
“less idle”.


Volodymyr (http://www.shcherbyna.com/)

a écrit dans le message de groupe de discussion :
xxxxx@ntdev…
> Hi,
>
> I need to find a way to get system wide keyboard/mouse idle time. The
> GetLastInputInfo function does not work for me since I need to know this
> info even when no one is logged in.
>
> One idea is to write keyboard and mouse filter drivers that would keep
> track of the time the last activity occurs. I was planning to use
> ZwGetTickCount but I am getting link errors. Perhaps I am missing
> something.
>
> If anyone has a better idea please share.
>
> Thanks
> RR
>

In our case, the computer would be considered as idle if no keyboard key strokes or mouse movements/ clicks are detected ( for lets say 20 minutes) and when this happens the software will either restart or power down the computer depending on how the software was configured by the user. I am not monitoring processes and the process activity is not my software’s concern because the main function of the software is to restore all changes to the computer at startup any way.

Thanks

Do you consider users logged on via terminal session? Or you only care about local ones?

I can use other techniques for remote users.

Considering that you can’t initiate a restart in KM anyways, I suggest you use the task scheduler and register an idle task. The concept of idle varies based on profile and release to release and the task scheduler is the standardized way to plug into the system’s idle detection engine. From your task, you can restart the machine

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@shaw.ca
Sent: Monday, November 01, 2010 11:50 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Finding System Wide Idle Time

In our case, the computer would be considered as idle if no keyboard key strokes or mouse movements/ clicks are detected ( for lets say 20 minutes) and when this happens the software will either restart or power down the computer depending on how the software was configured by the user. I am not monitoring processes and the process activity is not my software’s concern because the main function of the software is to restore all changes to the computer at startup any way.

Thanks


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Hmmm, thats an interesting idea. Is it possible to make that task hidden from users of the computer. Or more importantly, would users(Admins included) of the computer be able to modify/delete this task? If the answer is yes then this won’t work for me.
RR
P.S. Restart/Shutdown will be initiated from a user mode service not kernel mode.

>Or more importantly, would users(Admins included) of the computer be able to modify/delete this

task? If the answer is yes then this won’t work for me.

Admins can change anything in the computer, including setting some (and even not all) drivers and services of yours to Start=4.

So, protecting from admins just plain does not work.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

Ok, so we are back to the original idea of detecting mouse/keyboard activity.
This is what I was trying:
Modified the kbfltr example to use the ZwGetTickCount funtion but I got “error LNK2019: unresolved external symbol xxxxx@0 referenced in function _KbFilter_ServiceCallback@16”

Since ZwGetTickCount is an undocumented API, I was wondering if there is an equivalent API available in WDF.

xxxxx@shaw.ca wrote:

Hmmm, thats an interesting idea. Is it possible to make that task hidden from users of the computer. Or more importantly, would users(Admins included) of the computer be able to modify/delete this task? If the answer is yes then this won’t work for me.

Nothing you do can be hidden from administrators. That’s the whole
point of being an administrator.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Use KeQueryTickCount instead of ZwGetTickCount

Thanks Volodymyr that did it.

>>Thanks Volodymyr that did it. <<

But there is one thing one has to remember about ticks. They tick (i.e., increase) if your system is in standby mode.

Therefore, if you will be measuring “idle time” by ticks + some activity of mouse or kb, make sure you did not just had your system going out from standby as you will measure this as idle time and will reboot just de-standby system :slight_smile:

Thanks for the tip.