Solved: disable ctrl+alt+del | Experts Exchange

hi .... to disable Ctrl_Alt_Del isn't possible (on WinNT based systems) unless you replace the Windows GINA. Take a look at http://geocities.yahoo.com.br/armlessjohn/Hidden_Resources.html, there is a couple of good source codes to help you to program this ...

DragonSlayer

it is possible, knightmad, check my link above ;-)

knightmad

DragonSlayer: I did checked it : ) Last year, I wrote a couple of sources related to this subject (disabling Alt+Tab, Win Keys, Ctrl+Esc and so forth) and, except for Ctrl+Alt+del thing, the code I wrote was borrowed from that site you posted the link : ) , all I did was to convert the source from C++ to Delphi. And, although you can detect Ctrl+Alt+Del using a LowLevel keyboard hook, you cannot avoid that the Task Manager being shown, unless you turn on that registry key, having that annoying message ; )
So, I borrowed (again) some code from Jedi's site and adapted it to really disable the Ctrl+Alt+Del thing, having no message (well, it still have an annoting flickering, but it is acceptable)
Both source code and binaries are avaliable in that link I posted, because this is one of the most Frequent Asked Questions here in EE : ) We both were in a question like this months ago, and we answered exactly the same things there lol

sraab2004: take a look at these links, they are PAQ annd may help : )

https://www.experts-exchange.com/questions/20728852/Disable-Alt-Tab.html

https://www.experts-exchange.com/questions/20598492/Keyboard-hook-or-MSGina-dll.html

DragonSlayer

yup... deja vu all the time ;-)

wonder why some of the people who post questions never do a search first? Hmm...

smhp

/**************************************************************/
// Filename: Main.c
// Author : sima huapeng
// Time : 2002-10-13
// GINA : Graphical Identification and Authentication
// SAS : Secure Attention Sequence
/**************************************************************/

//10/13
// 实现自定义gina接口，设计与winlogon.exe的交互
// 开发原理：依赖Microsoft默认的gina dll:msgina.dll，在本dll中
// 导入msgina.dll导出的接口，在本dll的导出接口中，保持大部分接
// 口与msgina.dll操作的一致性，改变WlxLoggedOnSAS接口的响应，使
// 系统在登陆成功的状态下，根据设置，去定是否响应Ctrl+Alt+Del.
// 在启动后，按CTRL_ALT_DEL,系统会调用WlxLoggedOnSAS！
// 将这个DLL拷到system32目录下，并在注册表中加入：
// \HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
// 加一个GinaDLL,类型RegSZ, 内容为你的dll名，如:'myGina.dll'.
// 重起机器，系统就会使用你的dll,GINA可以实现很多东西，值得研究！
// 按下CTRL+ALT+DEL屏幕会闪一下，那是因为屏幕从Winsta0转到Desktop!
// 必须要用unicode,如果改了后启动不了，请将msgina.dll拷贝成你的dll,再启动！

//10/15
// 为了保护本Gina，本程序在退出时，应检测注册表

//10/16
// 暂时使用注册表通信

#define UNICODE
#include <windows.h>
#include <Winwlx.h>
#include <dbt.h>
#include "main.h"
#include "resource.h"

#define _DEBUG            //是否记录日志

#define ID_TIMER 32767

HINSTANCE myHandle = NULL;
HANDLE hGlobalWlx = NULL;
HANDLE hf = NULL;
PVOID g_pWinlogon = NULL;

void WriteInfo(const char * buf); //日志纪录
void LockWS(void); //锁定系统
BOOL SetRegFlag(void);                        //加入注册表
BOOL GetUsbFlag(void); //读取USB消息,如果成功则将消息复位

//-------------------------------------------------------------------------------------------
// 向外输出日志信息
void WriteInfo(const char * buf)
{
      #ifdef _DEBUG

      DWORD dwRt;
      int i = 0;
      if (hf != INVALID_HANDLE_VALUE){
            while (TRUE){
                  if (!buf[i])
                        break;
                  else
                        i++;
            }
            i++;
            WriteFile(hf, buf, i, &dwRt, NULL);
      }

      #endif
}

//-------------------------------------------------------------------------------------------
// 锁定系统
void LockWS(void)
{
HINSTANCE hlib = LoadLibrary(L"user32.dll");

if( hlib != NULL ) {
typedef BOOL (*LWS)(VOID);
LWS fnLockWorkStation = (LWS) GetProcAddress(hlib,"LockWorkStation");
if( fnLockWorkStation != NULL ) fnLockWorkStation();
FreeLibrary(hlib);
}
}

//-------------------------------------------------------------------------------------------
// 读取标志位
BOOL GetUsbFlag(void)
{
HKEY hKey = NULL;
DWORD mSubKey;
DWORD mType = REG_DWORD;
DWORD dwLen = sizeof(DWORD)+4;
DWORD mRegValue;
BOOL bRet = FALSE;
if ( RegCreateKeyEx( HKEY_LOCAL_MACHINE,
       L"Software\\Lanseal\\PAK",
                               0, L"", 0, KEY_ALL_ACCESS, NULL,
                               &hKey, &mRegValue ) == ERROR_SUCCESS )
{
       if ( RegQueryValueEx( hKey, L"FLAG",
              NULL, &mType,
                                          (LPBYTE)&mSubKey, &dwLen) == ERROR_SUCCESS )
       {
if (mSubKey > 0)
             {
              mRegValue = 0;
              if (RegSetValueEx(hKey, L"FLAG",
                   0L, REG_DWORD,
                                      (LPBYTE)&mRegValue, sizeof(DWORD) ) == ERROR_SUCCESS)
                   bRet = TRUE;
             }
       }
}
RegCloseKey(hKey);

return bRet;
};

//-------------------------------------------------------------------------------------------
// 加入注册表
BOOL SetRegFlag(void)
{
HKEY hKey = NULL;
UCHAR szBuf[80];
BOOL bRet = TRUE;

if (RegCreateKey(HKEY_LOCAL_MACHINE,
       TEXT("\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"), &hKey))
{
       bRet=FALSE;
};

strcpy(szBuf, "%SystemRoot%\\System32\\lsGina.dll");

if (RegSetValueEx(hKey, // subkey handle
TEXT("ginadll"),             // value name
0, // must be zero
REG_EXPAND_SZ, // value type
(LPBYTE) szBuf, // pointer to value data
strlen(szBuf) + 1)) // length of value data
{
bRet=FALSE;
}

RegCloseKey(hKey);
return bRet;
};

//-------------------------------------------------------------------------------------------
// 主函数的入口
BOOL WINAPI DllMain(
HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved
)
{
      switch (fdwReason){
      case DLL_PROCESS_ATTACH:
            hf = CreateFile(L"c:\\gina.txt", GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, NULL);

            WriteInfo("start 1.3 \r\n");            // 显示加载的版本

            myHandle = hinstDLL;

            if (LoadMsGina()){
                  WriteInfo("Init gina ok \r\n");
            }
            else
                  WriteInfo("Init gina false \r\n");

            break;
      case DLL_PROCESS_DETACH:
            ReleaseMsGina();

            WriteInfo("release gina ok \r\n");

            if (hf != INVALID_HANDLE_VALUE){
                  CloseHandle(hf);
            }
            break;
      }

      return TRUE;
}

//-------------------------------------------------------------------------------------------
// 用户登陆成功后，Winlogon.exe调用该函数启动用户外壳程序
BOOL WINAPI WlxActivateUserShell (
PVOID pWlxContext,
PWSTR pszDesktopName,
PWSTR pszMprLogonScript,
PVOID pEnvironment)
{
      WriteInfo("WlxActivateUserShell \r\n");

      LockWS();                         // 登陆成功后，开始验证身份

      return prcWlxActivateUserShell (
                          pWlxContext,
                          pszDesktopName,
                          pszMprLogonScript,
                          pEnvironment);
}

//-------------------------------------------------------------------------------------------
// 当没有任何用户登陆时，Winlogon.exe调用该函数显示一些提示信息
// 可以根据用户的动作模拟SAS事件的发送
VOID WINAPI WlxDisplaySASNotice (
PVOID pWlxContext)
{
      prcWlxDisplaySASNotice(pWlxContext);
}

//-------------------------------------------------------------------------------------------
// 初始化，winlogon.exe向gina dll传递需要版本的接口函数分配表
BOOL WINAPI WlxInitialize (
LPWSTR lpWinsta,
HANDLE hWlx,
PVOID pvReserved,
PVOID pWinlogonFunctions,
PVOID * pWlxContext)
{
hGlobalWlx = hWlx;
      g_pWinlogon = pWinlogonFunctions;

      return prcWlxInitialize (
              lpWinsta,
              hWlx,
              pvReserved,
              pWinlogonFunctions,
              pWlxContext);
}

//-------------------------------------------------------------------------------------------
// 当系统处于登陆成功，没有锁定的状态下
// Winlogon接收到SAS事件，于是调用该函数
// 现根据设置屏蔽所有事件，直接返回
int WINAPI WlxLoggedOnSAS (
PVOID pWlxContext,
DWORD dwSasType,
PVOID pReserved)
{
HANDLE hMutex;
WriteInfo("WlxLoggedOnSAS \r\n");

//屏蔽CTRL_ALT_DEL,也可以根据特定条件来决定是否要屏蔽
if (dwSasType == WLX_SAS_TYPE_CTRL_ALT_DEL ||
       dwSasType == WLX_SAS_TYPE_USER_LOGOFF ||
       dwSasType == WLX_SAS_TYPE_SCRNSVR_TIMEOUT ||
       dwSasType == WLX_SAS_TYPE_TIMEOUT ||
       dwSasType == WLX_SAS_TYPE_SWITCHUSER)
{
       //我采用了Mutex来控制是否屏蔽，（注意:要用unicode)
       hMutex = OpenMutex(MUTEX_ALL_ACCESS, FALSE, L"LANSEAL_CTRL_ALT_DEL");
       if (hMutex)
       {
              CloseHandle(hMutex);
              WriteInfo("disble CTRL+ALT+DEL \r\n");
              return WLX_SAS_ACTION_NONE; //返回就是退出
       }
       else
              WriteInfo("not disble CTRL+ALT+DEL \r\n");
}

return      prcWlxLoggedOnSAS (
       pWlxContext,
       dwSasType,
       pReserved);
}

//-------------------------------------------------------------------------------------------
// 在没有任何一个用户登陆的情况下，Winlogon.exe接收到SAS事件调用该函数
int WINAPI WlxLoggedOutSAS (
PVOID pWlxContext,
DWORD dwSasType,
PLUID pAuthenticationId,
PSID pLogonSid,
PDWORD pdwOptions,
PHANDLE phToken,
PWLX_MPR_NOTIFY_INFO pMprNotifyInfo,
PVOID * pProfile)
{
WriteInfo("WlxLoggedOutSAS \r\n");

return prcWlxLoggedOutSAS (
       pWlxContext,
       dwSasType,
       pAuthenticationId,
       pLogonSid,
       pdwOptions,
       phToken,
       pMprNotifyInfo,
       pProfile);
}

//-------------------------------------------------------------------------------------------
// Winlogon.exe调用该函数，通知gina dll用户注销操作
// 允许gina dll做出相应的处理
VOID WINAPI WlxLogoff (PVOID pWlxContext)
{
WriteInfo("WlxLogoff \r\n");
prcWlxLogoff(pWlxContext);
}

//-------------------------------------------------------------------------------------------
// Winlogon.exe调用的gina dll中的第一个函数
// 使gina dll确认是否支持当前版本的Winlogon.exe
// 传递给winlogon.exe需要那个版本的接口函数
BOOL WINAPI WlxNegotiate (
DWORD dwWinlogonVersion,
PDWORD pdwDllVersion)
{
WriteInfo("WlxNegotiate \r\n");
      return prcWlxNegotiate (
              dwWinlogonVersion,
              pdwDllVersion);
}

//-------------------------------------------------------------------------------------------
// 在屏保程序启动前一瞬Winlogon.exe调用该函数，允许gina dll同屏保程序交互
// 返回FALSE表示屏保程序不能启动
BOOL WINAPI WlxScreenSaverNotify (
PVOID pWlxContext,
BOOL *pSecure)
{
      WriteInfo("WlxScreenSaverNotify \r\n");
      return prcWlxScreenSaverNotify (
              pWlxContext,
              pSecure);
}

//-------------------------------------------------------------------------------------------
// 在系统关闭之前，Winlogon.exe调用该函数
// 允许gina dll处理一些系统关闭前的处理
VOID WINAPI WlxShutdown(
PVOID pWlxContext,
DWORD ShutdownType)
{
      WriteInfo("WlxShutdown \r\n");

SetRegFlag();                  // 我们在关闭前注册自己，这是一种保护策略

      prcWlxShutdown(pWlxContext, ShutdownType);
}

//-------------------------------------------------------------------------------------------
// 当系统要求在用户上下文中启动程序，Winlogon.exe调用该函数
// 这种情况发生在：浏览器非正常关闭需要重启或需要启动扩展的任务管理器
// 该接口gina dll可以选择性实现
BOOL WINAPI WlxStartApplication (
PVOID pWlxContext,
PWSTR pszDesktopName,
PVOID pEnvironment,
PWSTR pszCmdLine)
{
      WriteInfo("WlxStartApplication \r\n");
      return prcWlxStartApplication (
                   pWlxContext,
                   pszDesktopName,
                   pEnvironment,
                   pszCmdLine);
}

//-------------------------------------------------------------------------------------------
// 在锁定状态下，Winlogon.exe接收到SAS事件调用该函数
// 在这里返回无效信息，则可以屏蔽锁定状态下的消息
int WINAPI WlxWkstaLockedSAS (
PVOID pWlxContext,
DWORD dwSasType
)
{
      WriteInfo("WlxWkstaLockedSAS \r\n");
      return prcWlxWkstaLockedSAS (
              pWlxContext,
              dwSasType
            );
}

//-------------------------------------------------------------------------------------------
// 加入日期：10月13日下午18:28
// 修改日期：10月14日上午10:05
int CALLBACK LockedOffDlgProc(
HWND hDlg,
UINT Message,
WPARAM wParam,
LPARAM lParam)
{
RECT rcDlg;
int cx, cy;

switch (Message){
case WM_INITDIALOG: //窗口的初始化
WriteInfo("WM_INITDIALOG \r\n");

                  GetWindowRect(hDlg, &rcDlg);                         //得到窗口区域
cx = GetSystemMetrics(SM_CXSCREEN); //得到屏幕宽度
cy = GetSystemMetrics(SM_CYSCREEN); //得到屏幕高度

                  cx = (cx-(rcDlg.right-rcDlg.left)) / 2; //计算居中位置
                  cy = (cy-(rcDlg.bottom-rcDlg.top)) / 2;

                  SetWindowPos(hDlg, //设置窗口居中
                        HWND_TOP,
                        cx, cy, //窗口的位置坐标
                        0, 0,                                                       // ignores size arguments
                        SWP_NOSIZE);

                  SetTimer(hDlg, // handle to main window
                        ID_TIMER, // timer identifier
                        1000, // five-minute interval
                        (TIMERPROC) NULL); // no timer callback

return( TRUE );
                  break;
            case WM_TIMER:
                  if (GetUsbFlag())
                  {
                   WriteInfo("WM_GET_USB_TRUE \r\n");
                   KillTimer(hDlg, ID_TIMER);
EndDialog(hDlg, WLX_SAS_ACTION_LOCK_WKSTA);
return( TRUE );
                  }
}
return( FALSE );
}

//-------------------------------------------------------------------------------------------
// 修改日期：10月13日下午17:58
// 当系统处于锁定状态时，Winlogon.exe调用该函数
// 显示一些信息，如锁定者、锁定时间等
VOID WINAPI WlxDisplayLockedNotice(PVOID pWlxContext)
{
      int hDlgRet;

      hDlgRet = ((PWLX_DISPATCH_VERSION_1_3) g_pWinlogon)->
                        WlxDialogBoxParam(hGlobalWlx, myHandle,(unsigned short *)
                        MAKEINTRESOURCE(IDD_DIALOGMAIN),NULL,LockedOffDlgProc,0);

      if (hDlgRet==-1)
      {
prcWlxDisplayLockedNotice(pWlxContext);
      }

      WriteInfo("WlxDisplayLockedNotice \r\n");
}

//-------------------------------------------------------------------------------------------
// 当gina dll要显示一些信息时，Winlogon.exe调用该函数
// 直接返回TRUE表示信息已经显示
BOOL WINAPI WlxDisplayStatusMessage(
PVOID pWlxContext,
HDESK hDesktop,
DWORD dwOptions,
PWSTR pTitle,
PWSTR pMessage
)
{
      return prcWlxDisplayStatusMessage(
                   pWlxContext,
                   hDesktop,
                   dwOptions,
                   pTitle,
                   pMessage);
}

//-------------------------------------------------------------------------------------------
// Winlogon.exe调用该函数得到gina dll显示的状态信息
// 直接返回TRUE表示信息已经接收
BOOL WINAPI WlxGetStatusMessage(
PVOID pWlxContext,
DWORD *pdwOptions,
PWSTR pMessage,
DWORD dwBufferSize
)
{
      WriteInfo("WlxGetStatusMessage \r\n");
      return prcWlxGetStatusMessage(
                   pWlxContext,
                   pdwOptions,
                   pMessage,
                   dwBufferSize
                  );
}

//-------------------------------------------------------------------------------------------
// 在试图锁定工作站之前Winlogon.exe调用该函数，判断是否可以锁定
// 直接返回FALSE表示不能锁定
BOOL WINAPI WlxIsLockOk(PVOID pWlxContext)
{
      return prcWlxIsLockOk(pWlxContext);
}

//-------------------------------------------------------------------------------------------
// 在试图注销时Winlogon.exe调用该函数，判断能否注销
// 直接返回FALSE表示不能注销
BOOL WINAPI WlxIsLogoffOk(
PVOID pWlxContext
)
{
      WriteInfo("WlxIsLogoffOk \r\n");
      return prcWlxIsLogoffOk(
                  pWlxContext
      );
}

//-------------------------------------------------------------------------------------------
// Winlogon.exe调用该函数收集有效的认证信息
// 返回TRUE表示用户被识别
BOOL WINAPI WlxNetworkProviderLoad(
PVOID pWlxContext,
PWLX_MPR_NOTIFY_INFO pNprNotifyInfo
)
{
      WriteInfo("WlxNetworkProviderLoad \r\n");
      return prcWlxNetworkProviderLoad(
                  pWlxContext,
                  pNprNotifyInfo
      );
}

//-------------------------------------------------------------------------------------------
// Winlogon.exe调用该函数，告诉gina dll停止显示状态信息
// 直接返回TRUE表示信息已经删除
BOOL WINAPI WlxRemoveStatusMessage(
PVOID pWlxContext
)
{
WriteInfo("WlxRemoveStatusMessage \r\n");
      return prcWlxRemoveStatusMessage(
              pWlxContext
              );
}