安装KB2267602后Win32_PerfRawData_TermService_TerminalServicesSession失效求替代

问题背景与现象 #

安装**Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.431.159.0) - Current Channel (Broad)**更新后，出现以下异常：

1. WMI查询失效：针对ROOT\CIMV2命名空间的SELECT * FROM Win32_PerfRawData_TermService_TerminalServicesSession查询停止工作，已通过WMIExplorer验证该问题。
   用于执行查询的C#代码如下：

   internal static List<ManagementBaseObject> QueryInternal(string scopeNamespace, string query, bool ignoreErrors = false) {
       try {
           ManagementScope ws = GetManagementScope(scopeNamespace);
           if (!ws.IsConnected)
               throw new Exception("ManagementScope not connected");
           ManagementObjectSearcher searcher = new ManagementObjectSearcher(ws, new ObjectQuery(query));
           List<ManagementBaseObject> results = searcher.Get().Cast<object>().OfType<ManagementBaseObject>().ToList();
           return results;
       } catch (Exception e) {
           lock (ManagementScopePoolLock) {
               logger.Info($"Error - removing all cached scope namespaces - {e.Message}");
               ManagementScopePool.Clear();
           }
   
           if (!ignoreErrors) {
               logger.Error($"WMI QUERY FAILURE: namespace: \"{scopeNamespace}\" query: \"{query}\"");
               throw;
           } else {
               logger.Warn($"WMI QUERY FAILURE: namespace: \"{scopeNamespace}\" query: \"{query}\"");
               return new List<ManagementBaseObject>();
           }
       }
   }
   

2. 性能计数器无返回：在两台安装该更新的机器上，PerfMon无法加载「Terminal Services Session」计数器，对应代码仅输出FINISHED，无任何会话数据返回（未更新的机器可正常获取活跃用户会话统计）：

   PerformanceCounterCategory pcc = new PerformanceCounterCategory("Terminal Services Session");
   InstanceDataCollectionCollection idColCol = pcc.ReadCategory();
   foreach (var idCol in idColCol)
       logger.Info($"Instance: {idCol.ToString()}");
   Console.WriteLine("FINISHED");
   

需求 #

寻找替代方案，用于检测用户是完全登录状态还是仅处于锁屏状态。
补充：初步判断Win32_LogonSession可能是合适的替代WMI类。

内容的提问来源于stack exchange，提问作者Yet Another George