Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home› NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Finding System Wide Idle Time

OSR_Community_UserOSR_Community_User Member Posts: 110,217
in NTDEV
Hi,

I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.

One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.

If anyone has a better idea please share.

Thanks
RR
· Share on Facebook

Comments

  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,755
    Why? Do you want to run a task when the machine is idle?

    d

    dent from a phpne with no keynoard

    -----Original Message-----
    From: [email protected] <[email protected]>
    Sent: October 29, 2010 5:32 PM
    To: Windows System Software Devs Interest List <[email protected]>
    Subject: [ntdev] Finding System Wide Idle Time


    Hi,

    I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.

    One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.

    If anyone has a better idea please share.

    Thanks
    RR

    ---
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
    d
    · Share on Facebook
  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,627
    If nobody is logged in who is using the keyboard?


    Mark Roddy



    On Fri, Oct 29, 2010 at 8:32 PM, <[email protected]> wrote:
    > Hi,
    >
    > I need to find a way to get system wide keyboard/mouse idle time. The GetLastInputInfo function does not work for me since I need to know this info even when no one is logged in.
    >
    > One idea is to write keyboard and mouse filter drivers that would keep track of the time the last activity occurs. I was planning to use ZwGetTickCount but I am getting link errors. Perhaps I am missing something.
    >
    > If anyone has a better idea please share.
    >
    > Thanks
    > RR
    >
    > ---
    > NTDEV is sponsored by OSR
    >
    > For our schedule of WDF, WDM, debugging and other seminars visit:
    > http://www.osr.com/seminars
    >
    > To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
    >
    · Share on Facebook
  • Volodymyr_M._Shcherbyna-2Volodymyr_M._Shcherbyna-2 Member Posts: 169
    Define idle?

    You can have noone logged on machine, but yet, it is not idle, because some
    services (user mode or kernel mode) are doing something. The best idea which
    comes into my mind is using perf counters to track activity of Idle process
    or Process class.

    You can perform this from NT service and thus handle cases when noone is
    logged on. But with perf counters one has to suffer with localization (it is
    doable, just annoying). In NT service I guess you can also track session
    changes and see when someone is trying to logon, and thus system because
    "less idle".

    --
    Volodymyr (http://www.shcherbyna.com/)

    <[email protected]> a écrit dans le message de groupe de discussion :
    [email protected]
    > Hi,
    >
    > I need to find a way to get system wide keyboard/mouse idle time. The
    > GetLastInputInfo function does not work for me since I need to know this
    > info even when no one is logged in.
    >
    > One idea is to write keyboard and mouse filter drivers that would keep
    > track of the time the last activity occurs. I was planning to use
    > ZwGetTickCount but I am getting link errors. Perhaps I am missing
    > something.
    >
    > If anyone has a better idea please share.
    >
    > Thanks
    > RR
    >
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    In our case, the computer would be considered as idle if no keyboard key strokes or mouse movements/ clicks are detected ( for lets say 20 minutes) and when this happens the software will either restart or power down the computer depending on how the software was configured by the user. I am not monitoring processes and the process activity is not my software's concern because the main function of the software is to restore all changes to the computer at startup any way.

    Thanks
    · Share on Facebook
  • Volodymyr_M._Shcherbyna-2Volodymyr_M._Shcherbyna-2 Member Posts: 169
    Do you consider users logged on via terminal session? Or you only care about local ones?
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    I can use other techniques for remote users.
    · Share on Facebook
  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,755
    Considering that you can't initiate a restart in KM anyways, I suggest you use the task scheduler and register an idle task. The concept of idle varies based on profile and release to release and the task scheduler is the standardized way to plug into the system's idle detection engine. From your task, you can restart the machine


    d

    -----Original Message-----
    From: [email protected] [mailto:[email protected]] On Behalf Of [email protected]
    Sent: Monday, November 01, 2010 11:50 AM
    To: Windows System Software Devs Interest List
    Subject: RE:[ntdev] Finding System Wide Idle Time

    In our case, the computer would be considered as idle if no keyboard key strokes or mouse movements/ clicks are detected ( for lets say 20 minutes) and when this happens the software will either restart or power down the computer depending on how the software was configured by the user. I am not monitoring processes and the process activity is not my software's concern because the main function of the software is to restore all changes to the computer at startup any way.

    Thanks

    ---
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
    d
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hmmm, thats an interesting idea. Is it possible to make that task hidden from users of the computer. Or more importantly, would users(Admins included) of the computer be able to modify/delete this task? If the answer is yes then this won't work for me.
    RR
    P.S. Restart/Shutdown will be initiated from a user mode service not kernel mode.
    · Share on Facebook
  • Maxim_S._ShatskihMaxim_S._Shatskih Member Posts: 10,396
    >Or more importantly, would users(Admins included) of the computer be able to modify/delete this
    >task? If the answer is yes then this won't work for me.

    Admins can change anything in the computer, including setting some (and even not all) drivers and services of yours to Start=4.

    So, protecting from admins just plain does not work.

    --
    Maxim S. Shatskih
    Windows DDK MVP
    [email protected]
    http://www.storagecraft.com
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Ok, so we are back to the original idea of detecting mouse/keyboard activity.
    This is what I was trying:
    Modified the kbfltr example to use the ZwGetTickCount funtion but I got "error LNK2019: unresolved external symbol [email protected] referenced in function [email protected]"

    Since ZwGetTickCount is an undocumented API, I was wondering if there is an equivalent API available in WDF.
    · Share on Facebook
  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,558
    [email protected] wrote:
    > Hmmm, thats an interesting idea. Is it possible to make that task hidden from users of the computer. Or more importantly, would users(Admins included) of the computer be able to modify/delete this task? If the answer is yes then this won't work for me.

    Nothing you do can be hidden from administrators. That's the whole
    point of being an administrator.

    --
    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

    · Share on Facebook
  • Volodymyr_M._Shcherbyna-2Volodymyr_M._Shcherbyna-2 Member Posts: 169
    Use KeQueryTickCount instead of ZwGetTickCount
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Thanks Volodymyr that did it.
    · Share on Facebook
  • Volodymyr_M._Shcherbyna-2Volodymyr_M._Shcherbyna-2 Member Posts: 169
    >>Thanks Volodymyr that did it. <<

    But there is one thing one has to remember about ticks. They tick (i.e., increase) if your system is in standby mode.

    Therefore, if you will be measuring "idle time" by ticks + some activity of mouse or kb, make sure you did not just had your system going out from standby as you will measure this as idle time and will reboot just de-standby system :)
    · Share on Facebook
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Thanks for the tip.
    · Share on Facebook
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Sign In Register
Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 19-23 June 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online

Categories