How to take a screenshot of Window's secure desktop?

Question

By default, Windows Vista/7/8's UAC prompt is shown on a secure desktop. Unfortunately the Print Screen key doesn't seem to have any effect when viewing the secure desktop. I can see the reasoning behind this - no user-mode application should be able to capture the contents of the secure desktop.

However, my question remains: is there any way to get a screenshot of this desktop?

---

Edit: perhaps it would help if I explain the problem.

I am currently running Windows 8 and I have a small DisplayLink-based monitor that I would like to use. This driver was just released and works great - except it breaks on the secure desktop. I want to post a bug report on the forums there and in order to do so, I'd need a screenshot. Obviously the problem won't manifest itself on the standard desktop - and running Windows in a VM is impossible because Windows 8 requires hardware virtualization (which I don't have) and getting USB monitors to work with a VM is tricky at best anyway.

Answer 1

I have found a rather "black hat" way of doing it...

When in a secure desktop, the accessibility tools still work just fine... so, I used my copy of FastStone Capture Portable, I went to c:\windows\system32 and renamed osk.exe to osk.exe.old and copied/renamed fscapture.exe from the Faststone directory to osk.exe inside the system32 directory.

I then went to a UAC prompt and pressed Win Key+U, and clicked on the "on screen keyboard" option.

And... FastStone Capture started, although it was just a trial... using it under this mode cannot access my license details.... I was able to take a picture just fine and save it... although, when I thought I was saving to my desktop, it actually went to c:\windows\syswow64\config\systemprofile\desktop... you learn something new every day!

Based on the above, I always thought that the UAC secure desktop was an elevated environment using your own credentials, but, I guess it is actually launched under the System user - so, Print Screen may actually work, it just isn't under the context of your user - with this in mind, if you were to use a copy of paint instead of Fast Stone Capture, take a screenshot then launch Paint through the On Screen Keyboard hack, it may just work the same!

edit --- update ---

Paint is out the window! Just tested my theory and it didn't work, I am not sure the exact reason, but, I am guessing if you use pretty much any screen capture tool and my method above, it should work.

Answer 2

Get a digital camera and take a picture of the screen.

Answer 3

However, my question remains: is there any way to get a screenshot of this desktop?

A process running as SYSTEM and installed in an appropriate location can bypass UIPI and get on to the Secure Desktop.

Leverage the existing programs that do this -- RealVNC (not the free edition, unfortunately) and UltraVNC for example.

Run the server on your PC and connect the client to it from another computer. Take a screenshot of the client window.

Although it's probably just as easy to take a picture of the screen.

Answer 4

There is an even better way. With the help of two free open source tools, Greenshot and Process Hacker, you will be able to create a screenshot of the secure desktop with these benefits:

• No fiddling and no systemfile or registry changes required
• You don't need to type anything into a command prompt (for mouse users it's a benefit)

• It's easier to execute and, besides the first setup, a lot less time consuming. Let's start!

  1. Download Greenshot and configure the settings so it will autosave a picture of the whole screen to a folder if you're pressing the Print Screen key.

  2. Download Process Hacker. If you see the main window of Process Hacker, make sure Greenshot is closed and click on "Hacker" and "Run as..."

     

  3. Select the executable file of Greenshot in "Program". At "User name", click the list and choose "NT AUTHORITY\SYSTEM". "Type" should be Service, Session ID 1 and at "Desktop" select "WinSta0\Winlogon". This is important!

     

  4. Now you should be already good to go, click "OK", when Greenshot has finished loading (should be short), open an UAC window and press the Print Key. You should now see a picture of the secure desktop in your specified folder in Greenshot! If you don't need to create UAC screenshots anymore, simply kill the Greenshot process.

     

Have fun! I have confirmed and tested this by myself after several tests, because I haven't liked the solutions here so far.

Answer 5

I will offer another option than use virtual machine, vnc or changing registry or system files which maybe be nasty or impossible in some cases.

First you will need a screenshot software, for this answer I will use 7capture which is free, but I believe that can be done with others softwares.

Second you will need PsExec from PsTools suite, that tool will enable to put 7capture inside the Windows Secure Desktop, without changing any system files, just creating and removing a service which is automatically done by PsExec.

Then with the 7capture installed and with PsTools extracted to some folder do the following:

1) Open CMD as admin.

2) Set the current folder to the folder where PSTools was extracted: cd path_to\PSTools

3) Start 7capture inside the Windows Secure Desktop with the following command: PsExec /h /x /d /s "path_to\7capture.exe"

Where:

-h: If the target system is Vista or higher, has the process run with the account's elevated token, if available.

-x: Display the UI on the Winlogon secure desktop (local system only).

-d: Don't wait for process to terminate (non-interactive).

-s: Run the remote process in the System account.

4) Open the Windows Secure Desktop you want to take a shot. (UAC Prompt, Ctrl+Alt+Del screen etc.)

5) Use Ctrl+PrintScreen to take a shot of just one window, or PrintScreen to take a shot of the entire screen.

6) Use Alt+Tab to switch to the 7capture.

7) Just save the file where you want. (If you have problems with the fullscreen image, just save it as BMP)

And here you can see the results on my Windows 7 (Brazilian portuguese language):

Answer 6

If you install TeamViewer on your pc, and you have rebooted your pc, teamviewer will then be able to access the UAC prompt. From another pc that is using teamviewer, you can make a screenshot of your whole desktop while teamviewer is visible but does not have focus, and you'll have a screenshot of the UAC prompt.

Answer 7

Take screenshots anywhere

The secure desktop is active whenever any of the following occur: the user locks their desktop (Windows+L), the screen saver activates (when no user is logged in), or by default when User Account Control presents a prompt.

_{Source: XPDM vs. WDDM}

The idea is borrowed from William Hilsum's answer, but there's a difference: you don't need to replace any system file, and it's easier to undo the changes. After following the steps below, press Win+U whenever you need to take a screenshot of the secure desktop.

Override the Ease of Access utility

1. Open a command prompt as administrator.

2. Type or paste the following command, and replace X:\Path\to\file.exe with the actual path of the screen capturing tool executable of your choice. Then press Enter.

   reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /v "Debugger" /t REG_SZ /d "X:\Path\to\file.exe" /f
   

   Note Paint and the built-in Snipping Tool can't be used: you'll need to rely on third-party programs. Working tools are e.g Lightshot, Greenshot, and ShareX.

Revert back the changes

1. Open a command prompt as administrator.

2. Type or paste the following command, and press Enter:

   reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /f
   

Answer 8

Another option is to use autoitscript (from autoitscript.com)

It's a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation.

With send() function you can simulate the printscreen keypress. Taken from on site examples https://www.autoitscript.com/autoit3/docs/functions/Send.htm:

Example()

     Func Example()
          Send("{PRINTSCREEN}")
     EndFunc

Go here http://www.autoitscript.com/site/autoit/downloads/ to download it.

I haven't tried this solution myself but seems pretty decent given that you need to hack around to solve your issue.

Give it a try. Hope I helped.

Answer 9

I do not know much about secure desktop, but you could, in theory, be able to open Snipping Tool and use it to take a screenshot that way. No registry editing, no file renaming, none. This is very basic and easy method. Either search for "Snipping Tool" or open Run (keyboard shortcut: Win+R) and type "snippingtool" or "snippingtool.exe".

Either way, open it and use the "Full-screen snip" mode. In Windows 10, click the arrow next to the "Mode" button and select "Full-screen snip". In older Windows versions, click the arrow next to the "New" button and select "Full-screen snip". This is automatically copied to the Snipping Tool window where you can add notes, save the snip, or email it from the Snipping Tool window. See Microsoft's help page for more information.

Answer 10

Disable secure desktop for UAC, by using following steps:

1. Use the Windows key + R keyboard shortcut to open the Run command.
2. Type gpedit.msc and click OK to open the Local Group Policy Editor.
3. Browse the following path:

Computer Configuration > Windows Settings > Security Settings > Security Options

4. On the right side, double-click the User Account Control: Switch to the secure desktop when prompting for elevation policy.

Select the Disabled option.

6. Click Apply.
7. Click OK.

After that you can use normal print screen key on any elevated application.

Answer 11

I have been using Windows Vista SP2. I have not encountered such kind of restriction above. My print screen runs like a charm. You can not get rid of that unless disabling the UAC (User Account Controller). To do this, use msconfig.exe. Look up "disable UAC settings" such a thing there. Than install green shot; it is a useful program I think. I have been using this method without an hassle.