Logon Screen and Shutdown¶
A handful of Security Options control what happens at the login screen and at shutdown. Each closes a small hole that someone with physical access could use.
Where it is¶
secpol.msc → Local Policies → Security Options.
The settings¶
| Setting | Set to | Why |
|---|---|---|
| Interactive logon: Do not require CTRL+ALT+DEL (2.3.7.1, Level 2) | Disabled | The key combination is handled by Windows itself; a program can't intercept it. Requiring it means a fake login box can't collect your password. |
| Interactive logon: Don't display last signed-in | Enabled | Otherwise the login screen shows the last username, which is half of a login |
| Interactive logon: Message title for users attempting to log on (2.3.7.5) | A title, such as Authorized Use Only |
|
| Interactive logon: Message text for users attempting to log on (2.3.7.4) | A warning starting with "Unauthorized". Example: Unauthorized access to this system is prohibited. Activity is monitored. |
Legal notice; also confirms to a user they're on the right machine |
| Interactive logon: Machine inactivity limit | 900 seconds | Locks the screen after 15 minutes idle |
| Shutdown: Allow system to be shut down without having to log on | Disabled | Removes the power button from the login screen |
| Recovery console: Allow automatic administrative logon | Disabled | Booting to recovery would give admin without a password |
| Devices: Prevent users from installing printer drivers | Enabled | Printer drivers run as SYSTEM; see PrintNightmare |
| Devices: Restrict CD-ROM access to locally logged-on user only | Enabled | Legacy but harmless |
| Devices: Restrict floppy access to locally logged-on user only | Enabled | Same |
| Devices: Allowed to format and eject removable media | Administrators |
Step by step¶
secpol.msc→ Local Policies → Security Options.- The Interactive logon entries sort together. Set each row.
- Scroll to Shutdown, Recovery console, and Devices and set those.
- Log out and look at the login screen: the message should appear, and the last username should not.
Verify¶
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,"Authorized Use Only"
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7,Unauthorized access...
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,"1"
DisableCAD=4,0 means Ctrl+Alt+Del is required (the setting is phrased as "do not require," so Disabled = required).