Log Windows lock/unlock events

Log a dummy entry in the active window list whenever the system in
locked/unlocked.

Details of dummy entry are as follows :
PID = -1
ProcessName = "Microsoft"
MainWindowTitle = "Windows"
WindowTitle = "Locked" / "Unlocked"
TimeStamp = when system locked / unlocked

fixes #2

Author: TheCodeArtist

ActiveWindowLogger/frmMain.vb

@@ -9,6 +9,25 @@ Public Class frmMain
     Private Declare Function GetWindowText Lib "user32.dll" Alias "GetWindowTextA" (ByVal hWnd As IntPtr, ByVal WinTitle As String, ByVal MaxLength As Integer) As Integer
     Private Declare Function GetWindowTextLength Lib "user32.dll" Alias "GetWindowTextLengthA" (ByVal hwnd As Long) As Integer
 
+    Private Declare Function WTSRegisterSessionNotification Lib "Wtsapi32" (ByVal hWnd As IntPtr, ByVal THISSESS As Long) As Long
+    Private Declare Function WTSUnRegisterSessionNotification Lib "Wtsapi32" (ByVal hWnd As IntPtr) As Long
+
+    Private Const NOTIFY_FOR_ALL_SESSIONS As Integer = 1
+    Private Const NOTIFY_FOR_THIS_SESSION As Integer = 0
+    Private Const WM_WTSSESSION_CHANGE As Integer = &H2B1
+
+    Private Enum WTS
+        CONSOLE_CONNECT = 1
+        CONSOLE_DISCONNECT = 2
+        REMOTE_CONNECT = 3
+        REMOTE_DISCONNECT = 4
+        SESSION_LOGON = 5
+        SESSION_LOGOFF = 6
+        SESSION_LOCK = 7
+        SESSION_UNLOCK = 8
+        SESSION_REMOTE_CONTROL = 9
+    End Enum
+
     ' Set during app launch.
     ' Used to track how long the app has been runnning. 
     Dim AppLaunchTime As New Date
@@ -86,10 +105,58 @@ Public Class frmMain
     End Sub
 
     Private Sub frmMain_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
+        WTSRegisterSessionNotification(Me.Handle, NOTIFY_FOR_ALL_SESSIONS)
         chkStatus.Checked = True
         AppLaunchTime = DateTime.UtcNow
     End Sub
 
+    Protected Overrides Sub WndProc(ByRef m As System.Windows.Forms.Message)
+        Dim newEntry As ListViewItem
+
+        Select Case m.Msg
+            Case WM_WTSSESSION_CHANGE
+                Select Case m.WParam.ToInt32
+                    Case WTS.CONSOLE_CONNECT
+                        'Debug.Print("A session was connected to the console session.")
+                    Case WTS.CONSOLE_DISCONNECT
+                        'Debug.Print("A session was disconnected from the console session.")
+                    Case WTS.REMOTE_CONNECT
+                        'Debug.Print("A session was connected to the remote session.")
+                    Case WTS.REMOTE_DISCONNECT
+                        'Debug.Print("A session was disconnected from the remote session.")
+                    Case WTS.SESSION_LOGON
+                        'Debug.Print("A user has logged on to the session.")
+                    Case WTS.SESSION_LOGOFF
+                        'Debug.Print("A user has logged off the session.")
+                    Case WTS.SESSION_LOCK
+                        'Debug.Print("A session has been locked.")
+                        ' Populate the listview with Windows locked entry
+                        newEntry = lvEntries.Items.Insert(0, "-1")
+                        newEntry.SubItems.Add("Microsoft")
+                        newEntry.SubItems.Add("Windows")
+                        newEntry.SubItems.Add("Locked")
+                        newEntry.SubItems.Add(Format(Now, "yyyy/MM/dd HH:mm:ss"))
+                    Case WTS.SESSION_UNLOCK
+                        'Debug.Print("A session has been unlocked.")
+                        ' Populate the listview with Windows locked entry
+                        newEntry = lvEntries.Items.Insert(0, "-1")
+                        newEntry.SubItems.Add("Microsoft")
+                        newEntry.SubItems.Add("Windows")
+                        newEntry.SubItems.Add("Unlocked")
+                        newEntry.SubItems.Add(Format(Now, "yyyy/MM/dd HH:mm:ss"))
+                    Case WTS.SESSION_REMOTE_CONTROL
+                        'Debug.Print("A session has changed its remote controlled status. To determine the status, call GetSystemMetrics and check the SM_REMOTECONTROL metric.")
+                End Select
+        End Select
+
+        MyBase.WndProc(m)
+
+    End Sub
+
+    Private Sub Form1_FormClosing(ByVal sender As Object, ByVal e As System.Windows.Forms.FormClosingEventArgs) Handles Me.FormClosing
+        WTSUnRegisterSessionNotification(Me.Handle)
+    End Sub
+
     Private Sub lvEntries_ItemChecked(ByVal sender As Object, ByVal e As System.Windows.Forms.ItemCheckedEventArgs) Handles lvEntries.ItemChecked
         If (lvEntries.Items.Count <> lvEntries.CheckedItems.Count) And (lvEntries.CheckedItems.Count > 0) Then
             chkSelect.CheckState = CheckState.Indeterminate