7

I'm writing a service/user-mode application that may send the system into sleep after a certain customizable period of inactivity. The user-mode process may require to display a user message/warning before performing a power operation. This works great if a user is logged in, but if the workstation is locked, a user sees a display like this:

enter image description here

So I'm curious if it is possible to display my own window (overlay) above such a logon screen?

c00000fd
  • 20,994
  • 29
  • 177
  • 400
  • Interesting question. I know precious little about Windows internals, but my gut instinct is that this won't be possible, due to potential security implications (faking a login form). – Angew is no longer proud of SO Apr 17 '14 at 09:23
  • 1
    There are ways using Windows Interactive Logon Architecture. General idea can be seen here - http://stackoverflow.com/questions/12498019/how-to-display-ui-on-logon-screen-in-windows-7 – haxtbh Apr 17 '14 at 09:23
  • 1
    Or possibly [this question](http://stackoverflow.com/questions/9481621/running-a-form-in-windows-logon-screen-c-sharp?rq=1). – TripeHound Apr 17 '14 at 09:32
  • Thank you. Everyone seems to caution against it. Can someone give an example of why is it a security concern and how can it be exploited? – c00000fd Apr 17 '14 at 09:37
  • @c00000fd if one was feeling evil, one could write their own "login window" that would look and act just like the real one, except that it would also email the user's typed-in username and password to evilhackers.com for later (ab)use. – Jeremy Friesner Apr 20 '14 at 03:08
  • because anything that can draw over the login screen can fake it to take the user's password. That's why windows server have always required users to press ctrl+alt+del to login since nothing can catch that key combinations. So if someone runs a program, for example a screen saver, that looks like a login screen cannot have focus after pressing the key – phuclv Apr 20 '14 at 03:18

2 Answers2

1

The only supported API for this, since Vista, is the credential provider. The documentation can be found over on MSDN.

David Heffernan
  • 601,492
  • 42
  • 1,072
  • 1,490
1

I found this post that might be exactly what I need. I'll post later when I try it out...

c00000fd
  • 20,994
  • 29
  • 177
  • 400
  • 1
    The link is down. Fortunately the wayback machine still has it: http://web.archive.org/web/20150505112059/http://calebdelnay.com/blog/2012/01/displaying-a-program-on-the-windows-secure-desktop – Konrad Dec 02 '19 at 12:27