Currently I'm using the below code to test if the CTRL+ALT+DEL screen is visible and it is working as expected. The problem is that polling this info consumes CPU and I'm looking for an event based option. Does anyone know another way to detect if this screen is visible?
I only need to know when this screen is closed. I don't really care when it opens. Just that it had been open and is now closed.
To be honest, I found this code and I'm not exactly sure how it is specific, if at all, to the screen I'm referring to. It appears to look for any process creation and deletion events. What this means is that this screen must be opening a new process. Knowing that process name would be helpful too.
var interval = new TimeSpan(0, 0, 3);
const string isWin32Process = "TargetInstance isa \"Win32_Process\"";
// Listen for started processes.
WqlEventQuery startQuery = new WqlEventQuery("__InstanceCreationEvent", interval, isWin32Process);
var _startWatcher = new ManagementEventWatcher(startQuery);
_startWatcher.Start();
_startWatcher.EventArrived += OnStartEventArrived;
// Listen for closed processes.
WqlEventQuery stopQuery = new WqlEventQuery("__InstanceDeletionEvent", interval, isWin32Process);
var _stopWatcher = new ManagementEventWatcher(stopQuery);
_stopWatcher.Start();
_stopWatcher.EventArrived += OnStopEventArrived;
What is the name of this screen? And how do I detect this type of window? It seems like the same type as the login window.
