winapi - Disable Ctrl+Alt+Del on Windows 7

Question

I know this question has been asked a few times and in a few different ways. However, across all the questions and answers, no one has been able to answer completely given my situation...

I work on medical devices and they run Windows. The application runs as the shell, users shouldn't be able to get behind the application, and ideally they wouldn't be able to do anything that indicates that the system is running Windows. Access to the full keyboard is necessary so disabling, damaging or remapping keys is not a solution. Given that, we need to disable SAS/CAD/Ctrl+Alt+Delete in specific; some others too, but those are easy with hooks.

Up until recently we've been using Windows XP Embedded and could replace GINA, but we're about to switch to Windows 7 (technically Windows Embedded Standard 7; but in our case they're essentially the same) and GINA is no longer an option. There must be a way to do this.

Since I've seen comments about this on other questions: I do believe this belongs on Stack Overflow. Replacing GINA is a programming question and there's no reason to assume this won't be too. While I'm open to a non-programming solution, I doubt MS would make this kind of change available in the registry, etc.

Answer 1

Except for remapping/disabling keys, it is not possible to prevent Ctrl + Alt + Delete handling outside of kernel level code. I think this is fundamental security design feature of windows NT (and all derivatives). (Reasoning here.)

I would suggest writing a custom keyboard filter or device driver (or looking for an existing one perhaps). Not an easy task, but doable. Example resources:

• Keyboard Filter Driver for Windows Embedded Standard 7 - by Elbacom
• Interception (source) - A programming interface for intercepting input device communication.
• Writing a keyboard device driver

That first link to the Elbacom blog, in particular, could be useful since you are also targeting windows 7 embedded.

The second link, to Interception, is newer and might also be quite useful. It provides the kernel level module and abstracts some of the handling.

As a possible alternative, consider that though you can't disable the Ctrl + Alt + Delete hook without a device driver/filter, you can prevent all of the tasks that are accessible via that hook per changes to registry or with group policy editor. A previous edit of this answer linked to a utility called "Tweak Ctrl-Alt-Del Options" that made it very easy to disable all activities accessible via Ctrl-Alt-Del. That utility is no longer available from the original source, but is still find-able and there are others like it.