I have a form application that runs in the taskbar.  It is an audit trail application that captures all directory activity on a selected directory.  I can get everything I want except users logging off of the computer (either logoff or shutdown).  I believe the way to do it is through the session ending event handler.  But I can't seem to get any activity in the program when Windows logs off.  It just simply closes the program.

To attempt to capture the event, I placed a line in the Form1_Load

SystemEvents.SessionEnding +=new SessionEndingEventHandler(SystemEvents_SessionEnding);

I then create a method like

private void SystemEvents_SessionEnding(object sender, SessionEndingEventArgs e)
{
MessageBox.Show("Closing Form");
}

*Actually my code is much longer, but that is not so relevant here. I have the method write an event to an xml file.

Why doesn't this work (other than it's Windows)?  Or is there a better method of capturing a user logging off windows? 

Note: I don't want to capture users closing the program because they can't close the program.  It's supposed to monitor file activity.  This is for a regulated computer system.

Thanks
Jeff
IT by necessity