Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way for a laptop running Windows 7 to take a picture using the webcam after entering the wrong user password?

share|improve this question

4 Answers 4

Maybe you might wanna check the KeyLemon login manager. It's the only solution I was able to find that's close to what you need. Works on XP, Vista, 7 and 8. Unfortunately, this feature is present only in the paid version.

From the product page:

Hijackers tracking

With the hijackers tracking feature you can view pictures of:

  • who was in front of your computer before automatic windows lock
  • who typed a wrong password when computer was locked

Disclaimer: I'm in absolutely no way related to the product or company.

share|improve this answer

Yes, if you're familiar with windows MSGINA you could in theory create a custom login event which will start the camera on the laptop and snap a picture and save it to a custom folder

Reference: http://technet.microsoft.com/en-gb/library/bb742447.aspx

share|improve this answer
1  
Note that GINA is only XP and older, the Vista+ is different –  Scott Chamberlain May 20 '13 at 0:29

an invalid login has an logs as Event ID: 529 in the Security event log. You could write a script that monitors for that ID and then execute a command that would take a picture... not sure how to do the second part though...

share|improve this answer
    
Interesting approach –  That Brazilian Guy May 21 '13 at 12:51

What a cool question. Here is my solution (inspired in part by Keltari's answer):

Requirements

  • A somewhat recent version of Windows (probably Vista or later)
  • A DirectShow-compatible video device (probably anything Windows recognizes as a camera, and more)
  • ffmpeg.exe (http://ffmpeg.org/)

snapshot_login_failure.cmd (place this in some folder with ffmpeg.exe)

@echo off

:: Get date and time independent of regional settings. Source: http://stackoverflow.com/questions/203090/how-to-get-current-datetime-on-windows-command-line-in-a-suitable-format-for-us
for /F "usebackq tokens=1,2 delims==" %%i in (`wmic os get LocalDateTime /VALUE 2^>NUL`) do if '.%%i.'=='.LocalDateTime.' set ldt=%%j
set datetime=%ldt:~0,4%_%ldt:~4,2%_%ldt:~6,2%_%ldt:~8,2%_%ldt:~10,2%_%ldt:~12,2%

:: Capture snapshot through DirectShow using FFmpeg and save to disk. Change name of video adapter and save path.
ffmpeg.exe -f dshow -i video="USB 2.0 UVC HD Webcam" -vframes 1 E:\snapshot_%datetime%.jpg

snapshot_login_failure.xml (import this as a windows scheduler task)

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2013-07-06T23:32:34.0732602</Date>
    <Author>Zoe\Zero3</Author>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4625]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-19</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
    <UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>E:\snapshot_login_failure.cmd</Command>
      <WorkingDirectory>E:\</WorkingDirectory>
    </Exec>
  </Actions>
</Task>

Notes

  • You need to adjust device name and paths to fit your system. Perhaps the user accounts in the task file too.
  • You might need to enable logging of failed logins per Windows 7 Logon Failure Events Nonexistent?
  • The login failure event triggers after clicking OK on the "Wrong username or password bla bla" dialog and not immediately after entering invalid login info
  • There is noticable delay if triggered early after the login screen is shown during boot (when Windows is still starting services and the system is IO bound)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.