Is there a way to detect attended vs unattended?

I am building a process where users will run an attended job that simply prompts them with a form to fill out. This will put an item into a queue, which triggers an unattended job.

Rather than have two separate processes to publish and manage, is there a way to detect in my code if the job is being run attended vs unattended, so I can branch in the code?

I was hoping I could default the entry point to one xaml file (with the form prompt) and then configure the trigger to use a different entry point, but I don’t see such an option in the trigger. It would be nice if triggers could control the same things you enter when creating a process. Being able to use different entry points for different triggers, for the same process, would be great.

Hi Paul,

You have helped so many people with so many answers, that despite not having a solution, I wanted to see if I could spark ideas.

The one thing that I think may have value (I’m trying to research it right now) is the Windows Logon Type. I suspect (not sure yet) that the sessions by Unattended robots have a different Windows Logon Type (Event log ID 4624 in Windows Logs\Security) than a regular RPC or local login. So if we can find a non-administrator method of pulling that data through a script and find a difference, it would be possible to detect in said manner.

I’m not nearly 100% convinced this is the solution, so I’m sparked by your question enough to see if this adds up.

1 Like


Another thought I can apply in our RPA environment, which is more a workaround:
We have system AD accounts for robots that are used exclusively for unattended robots. Using the environment variable USERNAME I can identify if this matches against a list of system robot accounts, and if so it results in Unattended is True, otherwise it would be False.

Again, this is a workaround, and dependent on the use of AD accounts.

1 Like

We also have a standard for our service accounts for unattended jobs. This is definitely a possible solution, I was just wondering if there’s a more built-in way to detect the difference.

So far, I have found that my local login and RDC login sessions return Logon Type 7, while an Unattended Robot account returns Logon Type 2, 3, and 10. I have not yet determined a non-Administrator method of accumulating the data.

I used a PowerShell (Run As Administrator) from the internet to detect the information:

$CurrentUser = $env:USERNAME
$StartDate = (Get-Date).AddDays(-1)
Write-Host “Logged in user: $CurrentUser”
$EventEntries = Get-EventLog -LogName Security -After $StartDate | Where {$_.eventID -eq 4624 } | select -First 200
foreach($event in $EventEntries){
if($event.ReplacementStrings[5] -eq $CurrentUser){
write-host "Type: Local LogontDate: "$event.TimeGenerated "tStatus: SuccesstUser: "$event.ReplacementStrings[5] "tLogon Type: "$event.ReplacementStrings[8] -ForegroundColor Yellow
} else {
write-host "Type: Local LogontDate: "$event.TimeGenerated "tStatus: SuccesstUser: "$event.ReplacementStrings[5] "tLogon Type: "$event.ReplacementStrings[8]

In the script above put an apostrophe in front of the t for a tab for each write-host line. (the apostrophe is disregarded by this forum’s formatting. not to be confused with a single quote… same key as ~ but without using shift.)

Just to keep y’all updated on this interesting adventure…