Catching user logon/logoff events

[gewe]

Can anyone tell me what is wrong with the following code?
The code has to watch for logon/logoff events:

public void StartListenLogon()
{
EventHandler handler = new EventHandler();
WqlEventQuery query = new WqlEventQuery();

query.EventClassName = "__InstanceOperationEvent";
query.WithinInterval = new TimeSpan(0, 0, 3);
query.Condition = @"TargetInstance ISA 'Win32_LogonSession'";

LogonWatcher = new
System.Management.ManagementEventWatcher(query);
LogonWatcher.EventArrived += new
EventArrivedEventHandler(handler.Arrived);
LogonWatcher.Start();
}

public void Event_Arrived(object sender, EventArrivedEventArgs e)
{
//do something ...
}

The code is running in a Windows service.

When a user is logging on or logging off, no event is raised. Why?

If I change Win32_LogonSession into Win32_PnPEntity, I do get events
(like plugging in an USB device), even when no user is logged in. So
the code (and the service) seem to be working.