Detection of authentication state?

I've been tasked with creating a Vista CredSSP that will log on, lock and
unlock a user's desktop depending upon the state of an associated hardware
device. I've written Gina replacements before but never a CredSSP so I'd
appreciate a reality check from you more experienced Vista coders.

1) Given that this CredSSP must operate both from the secure desktop as well
as the user's desktop, should the CredSSP run as an automatic service? If
not, what would be a better way to do it?

2) How can the CredSSP (assuming that it is running as a service) determine
the current login/logout/locked state?
============
Richard Lewis Haggard