124

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination before logging in makes the system more secure. I have never encountered a VMS, UNIX or related system that makes you press any key to log in -- except older terminal-based UNIXes where you press ENTER to get a login prompt.

How does having to press CTRL-ALT-DEL before logging in make Windows more secure?

7
  • It would be interesting to contrast with Unix/Linux login methods, which do not require C-M-Del. Is this because Windows provides more login hooks than Unix systems?
    – spoulson
    May 2, 2009 at 1:25
  • 3
    It's also interesting that some (many, most?) Linux distributions are set up to perform an immediate reboot if you manage to get to the keyboard and hit ctrl+alt+del - with no user authentication required ^^ (configurable of course) May 2, 2009 at 1:50
  • 6
    to be pedantic, to initiate an immediate reboot. It's not a forced reboot; all processes get time to shut down, etc
    – Mikeage
    May 7, 2009 at 4:02
  • 2
    Yeah true - requests comment editing - not that the end-result difference really matters, but yes - it's a "nice" reboot - but a service denial nevertheless. On the other hand, physical access = anything goes May 7, 2009 at 13:36
  • 3
    @spoulson, I believe it's the other way around. There are several different gettys that you can run - some handle voice and fax - and that implies a modular way of handling logins. Then you also factor in the dusty-old concept of serial cable attached terminals, and pretty soon you realize that you can't just send Ctl-Alt-Del down a serial line that easily - what is the correct ANSI/ASCII sequence and do all terminals support it? So you're left with handling things as they are - which means, for better or worse, either the system is secure, or it isn't and it's keylogging your passwords. Oct 7, 2009 at 5:01

7 Answers 7

140

The Windows (NT) kernel is designed to reserve the notification of this key combination to a single process: Winlogon. So, as long as the Windows installation itself is working as it should - no third party application can respond to this key combination (if it could, it could present a fake logon window and keylog your password ;)

9
  • 6
    Right. The secure part is that once you press ctrl-alt-delete, you know that you're typing your password into the real Winlogon and not another program meant to look like it. May 2, 2009 at 8:02
  • 39
    You still have to trust the base system being unmodified no matter how you look at it - it's only to prevent user applications faking the logon screen on a local session. It helps, it does not completely prevent. Nothing is secure. May 2, 2009 at 12:44
  • 11
    @optician: The winlogon is replaceable through GINA - anyone can do it really, but you need admin privileges to do it. en.wikipedia.org/wiki/… May 19, 2009 at 7:36
  • 4
    I have VMWare installed on my laptop, and when the virtual server has control, it can sense that I've pressed ctrl-alt-del. But when I do so, the OS gets the prompt first and does what it usually does. Only when I hit Cancel, do I get a message box stating what to do when I want to send ctrl-alt-del to the virtual machine.
    – Kevin M
    Jul 5, 2009 at 7:12
  • 3
    It is not actually a hardware interrupt. Yes, the keyboard device generates interrupts, but C-A-D does not have special meaning to the hardware. It is coded into the software driver that handles keypresses. Dec 17, 2009 at 0:31
54

CTRL+ALT+DEL the history

Actually, I was just trying to solve a development problem that we had: brand new hardware, brand new software, you're testing this stuff out, it would hang up all the time. So the only solution you had was to turn the power off, wait a few seconds, turn the power back on, wait for it to go through the power on self test. I said, I'm writing all this code for the keyboard, I can .. let's just shortcut it. I originally intended for it to be what we would now call an easter egg, just something we were using in development, it wouldn't be available elsewhere. But then the pubs people found out about it. They're trying to figure out how to tell somebody to start up one of their programs, and they had the answer: just put the diskette in, hit CTRL+ALT+DEL, and by magic your program starts. So, it was like a five minute job in doing it. I didn't realize that I was going to create a cultural icon when I did it. But I have to share the credit; I may have invented it, but I think Bill [Gates] made it famous.

http://www.youtube.com/watch?v=1zADyh0JQh8

Quite a funny and informative clip, actually!

4
  • 5
    Man, the look billg gave that guy! Awesome!
    – jwalkerjr
    May 2, 2009 at 6:38
  • 6
    Interesting, but not exactly related to the question.
    – Scottie T
    May 4, 2009 at 14:03
  • Bill looked really p'd! I heard he got really heated in some of MS's meetings.
    – Kredns
    May 6, 2009 at 23:34
  • +1 for the look on Gates' face, but not actually an answer to the question =) May 19, 2009 at 8:00
27

Ctrl-Alt-Del is a Secure Attention Key that helps to prevent login spoofing.

1
18

Only programs with the highest operating privileges can hook that interrupt. Since the operating system reserves that privilege level for itself and won't let user programs run at that level, user level programs can't respond to that keystroke.

8

It's explained in the 'Help' link on the window that tells you to type Ctrl-Alt-Del.

5

How does having to press CTRL-ALT-DEL before logging in make Windows more secure?

No program running under Windows can hook Ctrl-Alt-Del,

so iff the box is running Windows you can be assured there's no login spoofing. Of course, it's trivial (FSVO "trivial") to spoof a Windows login screen complete with Ooh-Magic-Keys handling, and thus capture username/password pairs, by running Not-Windows.

Thus the answer to the OP's question is, fundamentally, In No Way.

0
2

Just something that kinda relates to this:

You can copy the command prompt into the login screen using a LiveCD and start it using the enable sticky keys shortcut (e.g. Shift+Shift+Shift+Shift+Shift). Which is really bad/good depending on how you use it (e.g. You can reset passwords using net user command).

Read more here: http://www.hackforums.net/printthread.php?tid=73864

7
  • 3
    Since you're using a livecd anyway, why not go for pnordahl's bootdisk home.eunet.no/pnordahl/ntpasswd/bootdisk.html and save yourself the trouble? May 11, 2009 at 18:54
  • 4
    +1 Piskvor. If you have physical access to the box, you own it anyway.
    – user3914
    Oct 8, 2009 at 13:46
  • Nice to see what people come up with, but Prerequisites: Guest account with write access to system 32 makes it a bit useless indeed? Still, +1 for linking to the print-layout of that forum, and not it's original. :-)
    – Arjan
    Oct 28, 2009 at 7:44
  • @Piskvor: I really didn't like using those bootdisk to reset passwords, it seemed much easier for me to use the net user command.
    – Kredns
    Oct 31, 2009 at 20:28
  • @Arjan My school system's XP boxes had that setup - all users, even the normally supposed-to-be-very locked-down students, had System32 write access. ...yeah. There were several students every year with the local administrator password for all the computers at the school. And with PsTools.
    – cpast
    May 15, 2014 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .