Why doesn't GetLastInputInfo() return info for the user I'm impersonating?
GetLastInputInfo() does not return info for an impersonated user because it queries the desktop's input state, not the thread's token. Impersonation changes the security context but not the desktop, so the function still reports the state of the thread's attached desktop, not the impersonated user's session.
Background
- Raymond Chen is a veteran Microsoft developer who writes "The Old New Thing" blog, explaining Windows internals and API quirks.
- **GetLastInputInfo()** is a Windows API function that returns the timestamp of the last user input (keyboard/mouse) on the current desktop session.
- **Impersonation** is a Windows security feature where a thread temporarily assumes the identity (access token) of another user — common in server apps and service processes.
- The article addresses a misunderstanding: developers who impersonate a user and then call GetLastInputInfo() expect it to return that user's last input time, but it doesn't work that way.
- The key insight: GetLastInputInfo() reports the last input for the *current desktop session*, not the impersonated user's session. Impersonation changes security context, not the desktop session — so the API still returns data for the session the thread is running in, not the impersonated user's separate session.