Thanks @DTS Engineer Kevin Elliott for your reply My larger goal here is at the lock screen I want to detect what events occured to reach this lock screen, is it logout,lock,restart or shutdown? Is there any kernel level file or any other changes I can track from daemon to get to know this

Thank you so much for reply, I am exploring below option for smart card Persistent tokens are not tied to hardware. You can create one that’s fully virtual, for example, one that works over the network It will be very helpful if There will be any implementation guide or sample for this

There was no edit option, so I am adding mechanism array here in structured form <array> <string>builtin:prelogin</string> <string>builtin:policy-banner</string> <string>loginwindow:login</string> <string>builtin:login-begin</string> <string>builtin:reset-password,privileged</string> <string>loginwindow:FDESupport,privileged</string> <string>builtin:forward-login,privileged</string> <string>builtin:auto-login,privileged</string> <string>builtin:authenticate,privileged</string> <string>PKINITMechanism:auth,privileged</string> <string>builtin:login-success</string> <string>loginwindow:success</string> <string>HomeDirMechanism:login,privileged</string> <string>HomeDirMechanism:status</string> <string>MCXMechanism:login</string> <string>CryptoTokenKit:login</string> <string>loginwindow:done</string> </array>