C#

class UserLogonData
{
    const string ALLUSERS = "All";

    readonly string userName;
    readonly DateTime loggedOnTime;
    string logonId;

    public string UserName
    {
        get { return this.userName; }
    }
    public DateTime LoggedOnTime
    {
        get { return this.loggedOnTime; }
    }
    public string LogonID
    {
        get { return this.logonId; }
    }
    public TimeSpan LoggedDuration
    {
        get { return DateTime.Now.Subtract(this.loggedOnTime); }
    }

    private UserLogonData(string userName, string logonId, DateTime loggedOnTime)
    {
        this.userName = userName;
        this.logonId = logonId;
        this.loggedOnTime = loggedOnTime;
    }

    public override string ToString()
    {
        return this.userName;
    }

    public static UserLogonData[] GetUsersLogonTime(string userName)
    {
        List<UserLogonData> dataList = new List<UserLogonData>();

        ManagementObjectSearcher mosUser = new ManagementObjectSearcher(new SelectQuery("Win32_LoggedOnUser"));
        ManagementObjectSearcher mosSession = new ManagementObjectSearcher(new SelectQuery("Win32_LogonSession"));

        ManagementObjectCollection mocUser = mosUser.Get();
        ManagementObjectCollection mocSession = mosSession.Get();

        foreach (ManagementObject moUser in mocUser)
        {
            string userLogonAntecedentData = moUser.Properties["Antecedent"].Value.ToString();
            string userLogonUserName = Regex.Replace(userLogonAntecedentData, @".*Name=""(?'name'.+)"".*", "${name}");
            if (userName!=ALLUSERS && userLogonUserName != userName) continue;
            string userLogonDependentData = moUser.Properties["Dependent"].Value.ToString();
            string userLogonSessionId = Regex.Replace(userLogonDependentData, @".*LogonId=""(?'id'\d+)"".*", "${id}");
            foreach (ManagementObject moSession in mocSession)
            {
                string sessionLogonId = moSession.Properties["LogonId"].Value.ToString();

                if (sessionLogonId == userLogonSessionId)
                {
                    string dateTime = moSession.Properties["StartTime"].Value.ToString();

                    string formattedDateTime = Regex.Replace(dateTime,
                        @"(?'year'\d{4})(?'month'\d{2})(?'day'\d{2})(?'hour'\d{2})(?'min'\d{2})(?'sec'\d{2})\.(?'mil'\d{0,3}).*",
                                    @"${year}/${month}/${day} ${hour}:${min}:${sec}.${mil}");

                    dataList.Add(new UserLogonData(userLogonUserName,userLogonSessionId
                                 ,DateTime.Parse(formattedDateTime)));
                }
            }
        }
        return dataList.ToArray();
    }

    public static UserLogonData[] GetUsersLogonTime()
    {
        return GetUsersLogonTime(ALLUSERS);
    }
}

(current user time line)
SYSTEM START>------|------------|--------|----------|------->NOW
             user A|user B      |user C  |user B    |user A
where "|" is a logout/switch operation.

gajatko wrote:

if e.g. some other guy kicked him out for a while because he "just wanted to check mailbox", but after that that guy could return back

gajatko wrote:

from yesterday evening, when Windows was hibernated (28 hours?? Oh God...).

hdv212 wrote:

when you can't help me, why post here ?

Luc Pattyn wrote:

Don't start new threads all the time: when the topic continues to be the same

Christian Graus wrote:

question is unintelligible