Detecting VNC Connect/Disconnect (Windows)

[bzowk]

Hey Guys -

I use VNC on all my systems and have a quick question. I'm trying to write a script which will kill a specific process whenever a user connects via VNC and execute a string to restart it once a user disconnects. What would be the best method or trigger for determining this? The only thing I could think of was to query netstat to see if port 5900 was Listening or Established, but it shows "Listening" even if someones connected. If you cant tell, I'm wanting to do this on my Windows (10) systems.

Any suggestions?

Thanks, but

[Rudi De Vos]

event id 1 == viewer connect
event id 3 == viewer diconnect
Using the event viewer you can add some tasks to event

Orde can be 1 1 3 3 1 3 1 3, you tasks need to take this in account