Ctrl+Alt+Del at a locked Windows computer
Windows can ask for Ctrl+Alt+Delete before it shows its sign-in screen, and computers in a domain usually do. In an ORelay remote desktop, the Ctrl+Alt+Del button gets past it, once Windows allows services to send the keys.
Why Windows has to allow it
No program can press Ctrl+Alt+Delete by sending keystrokes. Windows handles those keys below every program, so that the sign-in screen that follows is certainly Windows’s own and not a program dressed up as it. A service can ask Windows for the real thing, but only where a Windows policy allows services to. ORelay’s agent runs as a service, so that is the policy it needs.
The policy is for the whole computer: it lets every service on it ask for Ctrl+Alt+Delete, not only ORelay. That is why ORelay never sets it unless someone asks.
For a domain: Group Policy
In a GPO linked to the computers’ OU: Computer Configuration, Policies, Administrative Templates, Windows Components, Windows Logon Options, Disable or enable software Secure Attention Sequence: Enabled, with Services (or Services and Ease of Access applications).
It takes effect at the computers’ next Group Policy refresh (gpupdate /force to apply it now), without a restart. Where a GPO sets this value, Group Policy decides it, and a value set any other way is replaced at the next refresh.
For one computer: the registry
The policy is the DWORD value SoftwareSASGeneration under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System:
| Value | Who may send Ctrl+Alt+Delete |
|---|---|
| 0, or no value | Nothing (Windows’s default) |
| 1 | Services: what ORelay needs |
| 2 | Ease of Access applications |
| 3 | Services and Ease of Access applications |
To set it to 1, in a command prompt or PowerShell run as administrator:
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v SoftwareSASGeneration /t REG_DWORD /d 1 /f
When ORelay is installed
The Windows installer can set it as it installs: the “Allow remote sign-in” box in its wizard (unticked), ALLOW_REMOTE_SIGNIN=1 on a silent install’s command line, or “Let ORelay press Ctrl+Alt+Del on computers this installs” in Deploy to your fleet. Then it:
- writes 1, and only where nothing already allows services (a value of 1 or 3 is left as it is);
- records what was there before in
C:\ProgramData\ORelay\remote-signin.json; - puts that back when ORelay is uninstalled, as long as the value is still the one it wrote. A value someone changed since is left alone.
Where Group Policy sets the value, Group Policy wins.
From the remote desktop
An operator who has control of a remote desktop and presses Ctrl+Alt+Del on a computer that does not allow it is asked “Turn on Ctrl+Alt+Delete for this PC?”, in the web viewer and the ORelay apps. Saying yes:
- only ever adds services: no value or 0 becomes 1, and 2 becomes 3;
- is refused on a computer in a domain, which ORelay leaves to Group Policy, and where a policy sets the value;
- is in the Audit log, as is every press of the button;
- is never undone by ORelay; an administrator of the computer can.
Computers that do not ask for it
A computer where Windows does not ask for Ctrl+Alt+Delete (the security option Interactive logon: Do not require CTRL+ALT+DEL is enabled) shows its sign-in screen without it, and none of this is needed there. We do not suggest turning that requirement off for ORelay: allowing services to send the keys keeps it.