Why doesn't GetLastInputInfo() return info for the user I'm impersonating?
The article explains that GetLastInputInfo() returns the last input time for the current desktop's input queue, not for a specific user or thread. Even if impersonating another user, the function still reports the last input on the same interactive desktop session. To track input per user, separate desktop sessions or custom monitoring is needed.
Background
- **Raymond Chen** is a veteran Microsoft developer who writes "The Old New Thing" blog, known for deep dives into Windows API internals and historical design decisions.
- **GetLastInputInfo()** is a Windows function that returns the tick count since the last user input (keyboard/mouse) on the current session. It's commonly used for idle detection in security software, screensavers, or session lock tools.
- **Impersonation** is a Windows security feature where a thread temporarily assumes the access token (identity) of another user — e.g., a service running as SYSTEM can impersonate the logged-in user to perform actions on their behalf.
- The core issue: GetLastInputInfo() queries the physical console session's input state, not the calling thread's impersonation identity. So even if a thread impersonates User A, the function still reports the input activity of whoever is actually sitting at the machine (the console user). This trips up developers who expect impersonation to change the result.