Hello Paul and welcome to our forums,
First of all, sorry for my delayed reply.
What do you mean by "...when the user disconnects" ?
For example, here is a query that does an action (starts a program on the next log on) when a user logs off:
Code: Select all
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[\[]System[\[]Provider[\[]@Name='Microsoft-Windows-Security-Auditing'[\]] and (EventID=4634)[\]][\]]</Select>
</Query>
</QueryList>
You can include the above query in the "Event query subscription" field from the "Schedule" tab ("Edit Task Properties" window).
Please keep in mind that, upon inserting the query in Advanced Installer, you have to be aware of the square brackets ([,]) as strings that are contained by them (square brackets) are of formatted data type and they are actually references to certain special strings. In order to avoid this, you will have to find any square bracket from your initial query and resolve it like this: [\yourSquareBracketHere].
Here are some useful links for those said above:
-
Windows Installer Formatted Types
-
Event triggered Scheduled Tasks
Hope this helps!
Kind regards,
Catalin