windows - 在 Windows 上锁定计算机之前运行脚本

Question

我编写了一些 powershell，它允许我利用键盘媒体键的力量来控制当前正在运行的任何音乐。

我希望能够在计算机被锁定时运行脚本。所以我可以暂停/停止音乐。然后一旦机器解锁，恢复音乐。很酷吧？!

我的前 2 次尝试是:

1 - WMI 事件注册

这是锁定事件

Register-wmievent –query "Select * from __instancecreationevent within 1 where TargetInstance isa 'Win32_NTLogEvent' And TargetInstance.EventCode = 4800" -Action {write-host "Pausing`r`n"; set-playpausetrack}

这是解锁事件

Register-wmievent –query "Select * from __instancecreationevent within 1 where TargetInstance isa 'Win32_NTLogEvent' And TargetInstance.EventCode = 4801" -Action {write-host "Resuming`r`n"; set-playpausetrack}

不幸的是，我认为锁定事件触发得太晚了，此时操作系统出于安全原因停止了后台交互。当我解锁计算机时，它会同时触发锁定和解锁事件。

2 - 使用任务调度程序“工作站锁定”触发器

与上述类似的问题，但它也在不同的上下文中运行，因此无法正常工作。

有谁知道如何让脚本在系统实际锁定之前运行？ IE。有没有我可以观察的事件？

Answer 1

这似乎可行

PS> $sysevent = [microsoft.win32.systemevents]
PS> $sysevent

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     False    SystemEvents                             System.Object


PS> Register-ObjectEvent -InputObject $sysevent -EventName "SessionSwitch" -Action {[console]::Beep()}

Id              Name            State      HasMoreData     Location             Command
--              ----            -----      -----------     --------             -------
1               fa48b95f-299... NotStarted False                                [console]::Beep()

您可以找到 list of SytemEvents in Microsoft documentation .

DisplaySettingsChanged  Occurs when the user changes the display settings. 
DisplaySettingsChanging Occurs when the display settings are changing. 
EventsThreadShutdown    Occurs before the thread that listens for system events is terminated. 
InstalledFontsChanged   Occurs when the user adds fonts to or removes fonts from the system. 
LowMemory               Occurs when the system is running out of available RAM. 
PaletteChanged          Occurs when the user switches to an application that uses a different palette. 
PowerModeChanged        Occurs when the user suspends or resumes the system. 
SessionEnded            Occurs when the user is logging off or shutting down the system. 
SessionEnding           Occurs when the user is trying to log off or shut down the system. 
SessionSwitch           Occurs when the currently logged-in user has changed. 
TimeChanged             Occurs when the user changes the time on the system clock. 
TimerElapsed            Occurs when a windows timer interval has expired. 
UserPreferenceChanged   Occurs when a user preference has changed. 
UserPreferenceChanging  Occurs when a user preference is changing. 

注销事件

PS> Unregister-Event -SubscriptionId 1

如果你想能够区分Lock和Unlock，SessionSwitchEventHandler接收两个参数

1. 事件的来源。
2. SessionSwitchEventArgs 指示 session 更改事件的类型。

SessionSwitchEventArgs 拥有一个属性 Reason，它是一个枚举 SessionSwitchReason 值是:

ConsoleConnect        A session has been connected from the console.  
ConsoleDisconnect     A session has been disconnected from the console.  
RemoteConnect         A session has been connected from a remote connection.  
RemoteDisconnect      A session has been disconnected from a remote connection.  
SessionLogon          A user has logged on to a session.  
SessionLogoff         A user has logged off from a session.  
SessionLock           A session has been locked.  
SessionUnlock         A session has been unlocked.  
SessionRemoteControl  A session has changed its status to or from remote controlled mode.

示例:

PS> Register-ObjectEvent -InputObject $sysevent -EventName "SessionSwitch" -Action {[console]::Beep();Write-Host ($args[1]).Reason}

Id              Name            State      HasMoreData     Location             Command
--              ----            -----      -----------     --------             -------
9               20e6ecd4-fc0... NotStarted False                                [console]::Beep();fore...


PS >
SessionLock

SessionUnlock

如果你想要一个订阅的事件列表，你可以使用 Get-EventSubscriber :

SubscriptionId   : 5
SourceObject     : Microsoft.Win32.SystemEvents
EventName        : SessionSwitch
SourceIdentifier : 96fbabe4-518a-47b5-8a3f-bb89c68f7f39
Action           : System.Management.Automation.PSEventJob
HandlerDelegate  :
SupportEvent     : False
ForwardEvent     : False