I've found a way to disable the ctrl+alt+del menu for authenticated users. Turns out I did need to use a gina stub (actually, I modified an existing stub).
This gina stub apparently has several extra features such as forced logon / logoff scripts and disabling the ctrl+alt+del prompt before logging in without editing the registry. I had to use this one since Microsoft's example in the Windows XP platform SDK would not start up properly for me, and I couldn't find another suitable stub.
The only modification I made to the stub was to change the contents of WlxLoggedOnSAS in gina.c to
#ifdef DEBUGLOG
fprintf(fpginalog,"WlxLoggedOnSAS, SasType=%i.\n",dwSasType);
fflush(fpginalog);
#endif
if (dwSasType == WLX_SAS_TYPE_CTRL_ALT_DEL)
{
/* Eat the ctrl+alt+del event */
return WLX_SAS_ACTION_NONE;
}
else{
return GWlxLoggedOnSAS( pWlxContext, dwSasType, pReserved );
}
I then built the project in Visual Studio and moved the resulting newgina to C:\Windows\system32
The last step was to add a registry key to get it to load the gina stub on startup
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"GinaDLL"="C:\\windows\\system32\\newgina.dll"
Drawbacks:
This also disables ctrl+alt+del for
administrators, but they have the
start menu, so it isn't really a
problem for me. Could probably be
fixed with a little modification
If you don't use the explorer shell,
you aren't able to log out, resetting
the computer is your only option. It
might be possible to use another
program to register a hotkey for
logging out.
The screen flickers for a fraction of
a second when ctrl+alt+del is
pressed.
May not work on XP SP3 or Vista
(according to several threads on
other sites)
Note:
I don't have a binary version of the modified stub on hand right now (and Google's OpenID login is blocked at work, so I can't upload it from there,) but if you want to compile the stub yourself, just get the Visual C++ Express Edition and open the project, then replace the code inside WlxLoggedOnSAS in gina.c with the code mentioned earlier. When you build it, you should end up with a newgina.dll