C# Disable CTRL-ALT-DEL, ALT-TAB, ALT-F4, Start Menu and so on...

I wrote an article back in 2007 that is still around the web, in various discussions including StackOverflow and DotNetSpider, so I have decided to re-publish the article. This article was relevant back then - and it wasn't tested on a Windows 7 environment purely due to the fact that it did not exist and please also note that comments are disabled for this post.

Before continue reading please note that this article doesn’t intend to call upon you to create nasty applications. If you use this code it should be for your own fun or for learning purposes.

After doing some research on disabling keys or key combinations I found out that there are several ways of achieving the before mentioned key combos. CTRL-ALT-DEL combo is part of the SAS (http://en.wikipedia.org/wiki/Secure_attention_keySecure Attention Sequence) thus the solution to disable this is to write your own gina.dll (Graphical Identification and Authentication).

Don’t worry, I’m not looking into that as for now, I’m going to show you the work around. We will use C#’s Registry editing possibilities to set/change the group policy for the CTRL-ALT-DEL key sequence. Let’s see what we are about to do without programming anything. Open Start Menu > Run and enter gpedig.msc. Navigate to: User Configuration > Administrative Templates > System > CTRL+ALT+DELETE Options.This is the place where you normally set the behaviour of the key combo. Select Remove Task Manager > Double-click the Remove Task Manager option.

If you change it’s value, the following registry entry gets created/modified: Software\Microsoft\Windows\CurrentVersion\Policies\System and the value of DisableTaskMgr gets set to 1.

Now, the task is set. Let’s get down to business and start coding:

Important thing, don’t miss out this line:

using Microsoft.Win32;

And now the method I have created looks like this:

public void KillCtrlAltDelete()
{
  RegistryKey regkey;
  string keyValueInt = "1";
  string subKey = "Software\Microsoft\Windows\CurrentVersion\Policies\System";

  try
  {
    regkey = Registry.CurrentUser.CreateSubKey(subKey);
    regkey.SetValue("DisableTaskMgr", keyValueInt);
    regkey.Close();
  }
  catch (Exception ex)
  {
    MessageBox.Show(ex.ToString());
  }
}

So the CTRL-ALT-DEL combo has been taken care of, let’s see the rest. You might have found this a bit difficult, so here’s an easy one. How to disable ALT+F4. 5 lines of code alltogether:

private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
  e.Cancel = true;
  base.OnClosing(e);
}

Okay. As for the rest I was reading many many articles, and they gave a lot of help. I can’t name one, as I was looking into at least 15 which all held some useful peace of information. I will give you the the source of the method called hooks. The code snippet uses the LowLevelKeyboardProc which is:

The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was “injected”. However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.

Again, dont forget:

using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Diagnostics;

Here’s the rest what you need:

[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
public static extern int SetWindowsHookEx(int idHook, LowLevelKeyboardProcDelegate lpfn, int hMod, int dwThreadId);
[DllImport("user32", EntryPoint = "UnhookWindowsHookEx", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
public static extern int UnhookWindowsHookEx(int hHook);
public delegate int LowLevelKeyboardProcDelegate(int nCode, int wParam, ref KBDLLHOOKSTRUCT lParam);
[DllImport("user32", EntryPoint = "CallNextHookEx", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
public static extern int CallNextHookEx(int hHook, int nCode, int wParam, ref KBDLLHOOKSTRUCT lParam);
public const int WH_KEYBOARD_LL = 13;

/*code needed to disable start menu*/
[DllImport("user32.dll")]
private static extern int FindWindow(string className, string windowText);
[DllImport("user32.dll")]
private static extern int ShowWindow(int hwnd, int command);

private const int SW_HIDE = 0;
private const int SW_SHOW = 1;
public struct KBDLLHOOKSTRUCT
{
    public int vkCode;
    public int scanCode;
    public int flags;
    public int time;
    public int dwExtraInfo;
}
public static int intLLKey;

public int LowLevelKeyboardProc(int nCode, int wParam, ref KBDLLHOOKSTRUCT lParam)
{
    bool blnEat = false;

    switch (wParam)
    {
        case 256:
        case 257:
        case 260:
        case 261:
            //Alt+Tab, Alt+Esc, Ctrl+Esc, Windows Key,
            blnEat = ((lParam.vkCode == 9) && (lParam.flags == 32)) | ((lParam.vkCode == 27) && (lParam.flags == 32)) | ((lParam.vkCode == 27) && (lParam.flags == 0)) | ((lParam.vkCode == 91) && (lParam.flags == 1)) | ((lParam.vkCode == 92) && (lParam.flags == 1)) | ((lParam.vkCode == 73) && (lParam.flags == 0));
            break;
    }

    if (blnEat == true)
    {
        return 1;
    }
    else
    {
        return CallNextHookEx(0, nCode, wParam, ref lParam);
    }
}
public void KillStartMenu()
{
    int hwnd = FindWindow("Shell_TrayWnd", "");
    ShowWindow(hwnd, SW_HIDE);
}
private void Form1_Load(object sender, EventArgs e)
{
    intLLKey = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, System.Runtime.InteropServices.Marshal.GetHINSTANCE(System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}


Quite obviously you can programmatically reset these values. Here’s the code to re-enable everything:

public static void ShowStartMenu()
{
    int hwnd = FindWindow("Shell_TrayWnd", "");
    ShowWindow(hwnd, SW_SHOW);
}
public static void EnableCTRLALTDEL()
{
    try
    {
        string subKey = "Software\Microsoft\Windows\CurrentVersion\Policies\System";
        RegistryKey rk = Registry.CurrentUser;
        RegistryKey sk1 = rk.OpenSubKey(subKey);
        if (sk1 != null)
            rk.DeleteSubKeyTree(subKey);
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.ToString());
    }
}
private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
    UnhookWindowsHookEx(intLLKey);
}

I hope you enjoyed my article and that you found some useful bits. I tried to collect all the information I managed to find during my research on this topic.