How can I block Ctrl+Alt+Del when it's sent by BeyondTrust Privileged Remote Access to Windows 10 IoT Enterprise?

user_16280918 0
Viewed 44

BeyondTrust Privileged Remote Access has a button to send Ctrl+Alt+Del to the remote system. I've been able to block Ctrl+Alt+Del for non-remote use by using the HKLM:\SYSTEM\CurrentControlSet\Control\Keyboard Layout's Scancode Map property and/or Keyboard Filter. Neither of those block it when sent by Privileged Remote Access. Is there a way to block it when sent by Privileged Remote Access?

In the meantime, I've disabled all of the options on the Ctrl+Alt+Del screen by running the following PowerShell code:

# Disable Ctrl+Alt+Del screen Switch User option.
New-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name HideFastUserSwitching -Value 1

# Disable remaining Ctrl+Alt+Del screen options.
New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer -Name NoLogoff -Value 1
New-Item -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies -Name System
New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableChangePassword -Value 1
New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableLockWorkstation -Value 1
New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableTaskMgr -Value 1
keyboard windows
1 Answers

There are probably two ways to trigger C+A+D in software:

  • Keyboard driver. Not sure if the scancode map would handle that.

  • Simulate. Microsoft used to provide a library on request with a function called SimulateSAS. Windows 7 added SendSAS for everyone to use. There is also 3rd-party stuff that does it.

The group policy "Disable or enable software Secure Attention Sequence" can disable the simulation. A driver can be disabled/removed.

user_35010
Related