NT Gatekeeper: Disabling Options in the Security Dialog Box

Recently, a user crashed his workstation by killing some crucial processes. He pressed Ctrl+Alt+Del, selected Task Manager in the Windows NT security dialog box, then clicked End Process for several processes on the Processes tab. Can I disable some of the options in the security dialog box?

The NT security dialog box contains shortcuts that let users change their password, shut down or lock their workstation, log off, and access Task Manager. You can disable most of these options either by editing the registry or by using the NT 4.0 System Policy Editor (SPE). You can't disable the Shut Down button in the security dialog box; you control permission to shut down a system through the Shut down the system NT User right. The OS grants this right by default to members of the Administrators, Account Operators, Print Operators, Server Operators, and Backup Operators groups.

Table 1 summarizes the related registry settings for disabling security dialog box options through the registry. All the registry subkeys are in the HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem container. To use the SPE to disable these options, open the user properties and navigate to the Windows NT System container, which Figure 2 shows. Then, select the check boxes for the options you want to disable.

You can also restrict access to the taskmgr.exe executable, which is available by default on every Windows installation. You can delete it from your users' workstations, apply specific access control settings to it, or exclude it from the Run only allowed Windows applications setting in the SPE.