Block Ctrl+Alt+Del on a kiosk PC the supported way

Windows owns the three keys

Ctrl+Alt+Del is a secure attention sequence. Windows catches it before it reaches any application, so that no program can block it or draw a fake logon screen in its place. That design is also why keyboard-hook utilities fail here: a utility that swallows other shortcuts still leaves Ctrl+Alt+Del under Windows control, as the zenKeyBlock leaves Ctrl+Alt+Del under Windows control page documents. There is no runtime setting that intercepts the keys, because the keys never reach the runtime. What you can restrict is what the keys do next: open Task Manager, log the user off, or lock the session. Each of those is a Windows action with its own policy setting.

What one press opens, and what each result points to

Sign in at the kiosk the way an operator does and press Ctrl+Alt+Del once. On a Windows XP station the logon configuration decides the screen; newer Windows versions show their own security screen with Task Manager one click away, and the same identification applies.

• Task Manager opens straight away. The station signs in through the Welcome screen, and the keys go to Task Manager. Operators can end the runtime from its list. The setting to change covers Task Manager.
• The Windows Security dialog opens. The classic logon is in use. Three of its buttons end or freeze a kiosk session: Task Manager, Log Off and Lock Computer. The setting to change covers the button operators actually use.
• The desktop shows mid-shift with the runtime gone. Someone used End Task in Task Manager. Treat it as the Task Manager case.
• The Windows logon screen shows mid-shift. Someone used Log Off. That is a separate setting, and removing Task Manager leaves it in place.
• A locked screen nobody present can clear. Someone used Lock Computer, and only that account's password clears it. A locked kiosk stops work until the right person arrives.
• The PC hangs during the exit attempt. That is a runtime or station fault in its own right. Restricting the keys hides the route out and leaves the hang; fix the hang separately.

Identify the action before you change anything

Test from the exact operator account the kiosk uses. Policy applies per account, so the same keys pressed from an administrator account can open something else. Press Ctrl+Alt+Del once and record what opens, then reproduce the exit the way operators do it and note the button or menu item they use. Last, ask whether maintenance uses Task Manager on this PC to recover a hung runtime. If it does, set up the second account first: one restricted operator account, one administrator account for maintenance. Two accounts on the PC mean the restriction never touches the recovery tools.

The fix: one policy setting on the operator account

1. Sign in as administrator, open Start > Run, type gpedit.msc and press Enter. That is the Local Group Policy Editor, which ships with the Professional-class editions of Windows; the Home-class editions have none.
2. Under User Configuration, expand Administrative Templates.
3. Locate the policies that govern Task Manager, logging off and locking the computer. They sit in different subfolders, so read the description pane for each one before you change anything and record its current state.
4. Enable only the setting that matches the action you identified. For a Task Manager exit, that is the setting whose description says it removes Task Manager from this account's users. Leave every other setting at Not Configured.
5. Close the editor and sign the operator account out and back in once. User policies load at sign-in; the reload takes one sign-out and one sign-in, about 30 seconds.
6. From the operator account, press Ctrl+Alt+Del again. Task Manager should return the message that it has been disabled by your administrator, and the runtime should keep running.

Restricting the Windows exits pairs with locking the runtime's own setup screen; password protect the HMI setup menu key path covers that menu path. On a Windows 10 kiosk, the built-in kiosk mode assigns one full-screen app to one account and does most of this work in one place; the usual snag is an app that never appears in the picker, which why your signage player is missing from Windows 10 kiosk mode walks through.

Example: one Windows XP kiosk where the exit is Task Manager

Inputs: a Windows XP PC that auto-starts the runtime after sign-in; the fault on record is operators leaving the runtime and hanging the PC; the station signs in through the Welcome screen; two accounts are planned, operator and administrator. The logon behavior and the policy tools come from Windows' own documentation and the editor named above.

The rule in words: Windows takes the three keys before any program, so the change is one Windows policy on one action, applied to one account.

The arithmetic:

• 3 keys pressed -> 1 screen opens: Task Manager, because the Welcome screen logon is in use
• 1 screen -> 1 exit route in use: End Task on the runtime
• 1 route -> 1 policy to enable: the Task Manager removal setting under User Configuration
• 0 of the other 2 candidate settings change: Log Off and Lock Computer stay Not Configured
• 1 sign-out and sign-in, about 30 seconds, loads the policy
• 2 test sign-ins close the job: operator first, then administrator, in a 15-minute bench drill

Result: from the operator account, Ctrl+Alt+Del now brings back the message that Task Manager has been disabled by your administrator, End Task is gone from that account, and the runtime keeps running. The administrator account still opens Task Manager for recovery. Total station downtime for the change: under 30 minutes.

Decision: this single setting is the right change while the one-press test opens Task Manager. If the same test opens the Windows Security dialog instead, the count moves to the dialog: the exit is one of its 3 buttons, the setting to enable covers that button, and the Task Manager setting stays at Not Configured unless operators also end tasks there.

Keep the recovery path working

Prove recovery before the restriction goes live. Sign in as administrator and open Task Manager once to note the runtime's process name. After the policy is set, run the drill on the bench: end or hang the runtime deliberately, sign in as administrator, end the stuck process and restart the runtime. If recovery depends on a password only one person knows, the station is one absent employee away from a stopped line, so write down who holds the administrator password and how the runtime restarts.

If the runtime still hangs with the restriction live, set the policy back to Not Configured and treat the hang as its own fault. A locked-down PC with a hung runtime and no reachable administrator stops production, and that is the one failure this work must never create.

The screen next to the kiosk PC

A locked-down kiosk PC serves one operator. The line around it often needs a notice or andon board that the whole crew reads from a distance, and that is a separate screen with its own sizing sums: plan 30 ft of viewing distance per inch of letter height, and start from choosing an offline signage kiosk display for an operator view. Our shop-floor screens are built for that second job.

Quick fixes to skip

Recommendation: Put two accounts on every kiosk PC, one restricted operator account for the runtime and one administrator account for maintenance. Run the one-press Ctrl+Alt+Del test from the operator account, enable only the policy that removes the action operators actually use, and add a second policy only after you see a second route used. Sign in to the administrator account and run the 15-minute recovery drill before the station goes back into service.

Questions