Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When logging into Windows, it says on that page that CTRL-ALT-DEL somehow makes Windows more secure. I have never been able to figure a mechanism where having to press some specific key combination before logging in makes the system more secure. I have never encountered a VMS, UNIX or related system that makes you press any key to log in -- except older terminal-based UNIXes where you press ENTER to get a login prompt.

How does having to press CTRL-ALT-DEL before logging in make Windows more secure?

share|improve this question
    
It would be interesting to contrast with Unix/Linux login methods, which do not require C-M-Del. Is this because Windows provides more login hooks than Unix systems? –  spoulson May 2 '09 at 1:25
2  
It's also interesting that some (many, most?) Linux distributions are set up to perform an immediate reboot if you manage to get to the keyboard and hit ctrl+alt+del - with no user authentication required ^^ (configurable of course) –  Oskar Duveborn May 2 '09 at 1:50
3  
to be pedantic, to initiate an immediate reboot. It's not a forced reboot; all processes get time to shut down, etc –  Mikeage May 7 '09 at 4:02
1  
Yeah true - requests comment editing - not that the end-result difference really matters, but yes - it's a "nice" reboot - but a service denial nevertheless. On the other hand, physical access = anything goes –  Oskar Duveborn May 7 '09 at 13:36
2  
@spoulson, I believe it's the other way around. There are several different gettys that you can run - some handle voice and fax - and that implies a modular way of handling logins. Then you also factor in the dusty-old concept of serial cable attached terminals, and pretty soon you realize that you can't just send Ctl-Alt-Del down a serial line that easily - what is the correct ANSI/ASCII sequence and do all terminals support it? So you're left with handling things as they are - which means, for better or worse, either the system is secure, or it isn't and it's keylogging your passwords. –  Avery Payne Oct 7 '09 at 5:01
show 2 more comments

7 Answers 7

up vote 103 down vote accepted

The Windows (NT) kernel is designed to reserve the notification of this key combination to a single process: Winlogon. So, as long as the Windows installation itself is working as it should - no third party application can respond to this key combination (if it could, it could present a fake logon window and keylog your password ;)

share|improve this answer
    
So faking the keyboard interrupt is okay for an app (to make remote desktop applications work), but faking the response is impossible? –  Tomalak May 2 '09 at 7:35
4  
Right. The secure part is that once you press ctrl-alt-delete, you know that you're typing your password into the real Winlogon and not another program meant to look like it. –  Stephen Jennings May 2 '09 at 8:02
26  
You still have to trust the base system being unmodified no matter how you look at it - it's only to prevent user applications faking the logon screen on a local session. It helps, it does not completely prevent. Nothing is secure. –  Oskar Duveborn May 2 '09 at 12:44
6  
@optician: The winlogon is replaceable through GINA - anyone can do it really, but you need admin privileges to do it. en.wikipedia.org/wiki/… –  Commander Keen May 19 '09 at 7:36
2  
I have VMWare installed on my laptop, and when the virtual server has control, it can sense that I've pressed ctrl-alt-del. But when I do so, the OS gets the prompt first and does what it usually does. Only when I hit Cancel, do I get a message box stating what to do when I want to send ctrl-alt-del to the virtual machine. –  Kevin M Jul 5 '09 at 7:12
show 4 more comments

CTRL+ALT+DEL the history

Actually, I was just trying to solve a development problem that we had: brand new hardware, brand new software, you're testing this stuff out, it would hang up all the time. So the only solution you had was to turn the power off, wait a few seconds, turn the power back on, wait for it to go through the power on self test. I said, I'm writing all this code for the keyboard, I can .. let's just shortcut it. I originally intended for it to be what we would now call an easter egg, just something we were using in development, it wouldn't be available elsewhere. But then the pubs people found out about it. They're trying to figure out how to tell somebody to start up one of their programs, and they had the answer: just put the diskette in, hit CTRL+ALT+DEL, and by magic your program starts. So, it was like a five minute job in doing it. I didn't realize that I was going to create a cultural icon when I did it. But I have to share the credit; I may have invented it, but I think Bill [Gates] made it famous.

http://www.youtube.com/watch?v=1zADyh0JQh8

Quite a funny and informative clip, actually!

share|improve this answer
4  
Man, the look billg gave that guy! Awesome! –  jwalkerjr May 2 '09 at 6:38
3  
Interesting, but not exactly related to the question. –  Scottie T May 4 '09 at 14:03
    
Bill looked really p'd! I heard he got really heated in some of MS's meetings. –  Lucas McCoy May 6 '09 at 23:34
    
+1 for the look on Gates' face, but not actually an answer to the question =) –  Commander Keen May 19 '09 at 8:00
add comment

Ctrl-Alt-Del is a Secure Attention Key that helps to prevent login spoofing.

share|improve this answer
add comment

Only programs with the highest operating privileges can hook that interrupt. Since the operating system reserves that privilege level for itself and won't let user programs run at that level, user level programs can't respond to that keystroke.

share|improve this answer
add comment

It's explained in the 'Help' link on the window that tells you to type Ctrl-Alt-Del.

share|improve this answer
add comment

How does having to press CTRL-ALT-DEL before logging in make Windows more secure?

No program running under Windows can hook Ctrl-Alt-Del,

so iff the box is running Windows you can be assured there's no login spoofing. Of course, it's trivial (FSVO "trivial") to spoof a Windows login screen complete with Ooh-Magic-Keys handling, and thus capture username/password pairs, by running Not-Windows.

Thus the answer to the OP's question is, fundamentally, No.

share|improve this answer
add comment

Just something that kinda relates to this:

You can copy the command prompt into the login screen using a LiveCD and start it using the enable sticky keys shortcut (e.g. Shift+Shift+Shift+Shift+Shift). Which is really bad/good depending on how you use it (e.g. You can reset passwords using net user command).

Read more here: http://www.hackforums.net/printthread.php?tid=73864

share|improve this answer
2  
Since you're using a livecd anyway, why not go for pnordahl's bootdisk home.eunet.no/pnordahl/ntpasswd/bootdisk.html and save yourself the trouble? –  Piskvor May 11 '09 at 18:54
2  
+1 Piskvor. If you have physical access to the box, you own it anyway. –  user3914 Oct 8 '09 at 13:46
    
Nice to see what people come up with, but Prerequisites: Guest account with write access to system 32 makes it a bit useless indeed? Still, +1 for linking to the print-layout of that forum, and not it's original. :-) –  Arjan Oct 28 '09 at 7:44
    
@Piskvor: I really didn't like using those bootdisk to reset passwords, it seemed much easier for me to use the net user command. –  Lucas McCoy Oct 31 '09 at 20:28
    
@Arjan My school system's XP boxes had that setup - all users, even the normally supposed-to-be-very locked-down students, had System32 write access. ...yeah. There were several students every year with the local administrator password for all the computers at the school. And with PsTools. –  cpast May 15 at 7:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.