# How to take a screenshot of Window's secure desktop?

By default, Windows Vista/7/8's UAC prompt is shown on a secure desktop. Unfortunately the Print Screen key doesn't seem to have any effect when viewing the secure desktop. I can see the reasoning behind this - no user-mode application should be able to capture the contents of the secure desktop.

However, my question remains: is there any way to get a screenshot of this desktop?

Edit: perhaps it would help if I explain the problem.

I am currently running Windows 8 and I have a small DisplayLink-based monitor that I would like to use. This driver was just released and works great - except it breaks on the secure desktop. I want to post a bug report on the forums there and in order to do so, I'd need a screenshot. Obviously the problem won't manifest itself on the standard desktop - and running Windows in a VM is impossible because Windows 8 requires hardware virtualization (which I don't have) and getting USB monitors to work with a VM is tricky at best anyway.

-
You can run it in a virtual machine. –  jdigital Jan 27 '12 at 0:35
@user8368: That's not an option since I'm trying to get the screenshot to demonstrate a particular hardware problem that may not show up in a VM. It's also not an option from a licensing perspective. And lastly, I don't have hardware virtualization, so it would make the whole thing very difficult. –  Nathan Osman Jan 27 '12 at 0:41
You can set the UAC prompt to not use the secure desktop through (Local) Group Policy. –  billc.cn Jan 27 '12 at 0:42
@billc.cn: I know, but then the problem that I'm trying to get a screenshot of won't manifest itself. –  Nathan Osman Jan 27 '12 at 0:44
@GeorgeEdison: Are you sure? By turning off the Secure Desktop, the UAC prompt will still fire. But since it isn't on the secure desktop, other applications can screenshot it. –  surfasb Jan 27 '12 at 1:05

I have found a rather "black hat" way of doing it...

When in a secure desktop, the accessibility tools still work just fine... so, I used my copy of FastStone Capture Portable, I went to c:\windows\system32 and renamed osk.exe to osk.exe.old and copied/renamed fscapture.exe from the Faststone directory to osk.exe inside the system32 directory.

I then went to a UAC prompt and pressed Win Key+U, and clicked on the "on screen keyboard" option.

And... FastStone Capture started, although it was just a trial... using it under this mode cannot access my license details.... I was able to take a picture just fine and save it... although, when I thought I was saving to my desktop, it actually went to c:\windows\syswow64\config\systemprofile\desktop... you learn something new every day!

Based on the above, I always thought that the UAC secure desktop was an elevated environment using your own credentials, but, I guess it is actually launched under the System user - so, Print Screen may actually work, it just isn't under the context of your user - with this in mind, if you were to use a copy of paint instead of Fast Stone Capture, take a screenshot then launch Paint through the On Screen Keyboard hack, it may just work the same!

edit --- update ---

Paint is out the window! Just tested my theory and it didn't work, I am not sure the exact reason, but, I am guessing if you use pretty much any screen capture tool and my method above, it should work.

-
This is brilliant! –  iglvzx Jan 27 '12 at 1:51
This is a very clever use of the accessibility tools :) –  Nathan Osman Jan 27 '12 at 2:47
I suspect Paint doesn't ask for UIAccess permissions to play nice with UIPI, whereas the other accessibility applications do. See UIAccess for UI automation applications over here for the requirements. –  ta.speot.is Jan 27 '12 at 3:17
@todda.speot.is Interesting and will read as I am interested to learn, but, I think there may be more to it as well - I can't imagine Faststone Capture implementing this, it must be that print screen is simply disabled by default and most screen capture utilities just override default behaviour... (I know MS has the technology to disable bits - e.g. MS DRM enterprise suite (forget real name) disables print screen and many other features). –  William Hilsum Jan 27 '12 at 9:33
+1 for work around –  Joshua Drake Jan 27 '12 at 16:17

Get a digital camera and take a picture of the screen.

-
This also came to mind for me as well. Not as elegant but much less of a headache. –  Paperlantern Jan 27 '12 at 4:13

However, my question remains: is there any way to get a screenshot of this desktop?

A process running as SYSTEM and installed in an appropriate location can bypass UIPI and get on to the Secure Desktop.

Leverage the existing programs that do this -- RealVNC (not the free edition, unfortunately) and UltraVNC for example.

Run the server on your PC and connect the client to it from another computer. Take a screenshot of the client window.

Although it's probably just as easy to take a picture of the screen.

-
Oh that's right... I have another machine I can VNC to and see the secure desktop - I totally forgot about that. –  Nathan Osman Jan 27 '12 at 2:40

If you install TeamViewer on your pc, and you have rebooted your pc, teamviewer will then be able to access the UAC prompt. From another pc that is using teamviewer, you can make a screenshot of your whole desktop while teamviewer is visible but does not have focus, and you'll have a screenshot of the UAC prompt.

-

Another option is to use autoitscript (from autoitscript.com)

It's a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation.

With send() function you can simulate the printscreen keypress. Taken from on site examples https://www.autoitscript.com/autoit3/docs/functions/Send.htm:

Example()

Func Example()
Send("{PRINTSCREEN}")
EndFunc


I haven't tried this solution myself but seems pretty decent given that you need to hack around to solve your issue.

Give it a try. Hope I helped.

-

I will offer another option than use virtual machine, vnc or changing registry or system files which maybe be nasty or impossible in some cases.

First you will need a screenshot software, for this answer I will use 7capture which is free, but I believe that can be done with others softwares.

Second you will need PsExec from PsTools suite, that tool will enable to put 7capture inside the Windows Secure Desktop, without changing any system files, just creating and removing a service which is automatically done by PsExec.

Then with the 7capture installed and with PsTools extracted to some folder do the following:

2) Set the current folder to the folder where PSTools was extracted: cd path_to\PSTools

3) Start 7capture inside the Windows Secure Desktop with the following command: PsExec /h /x /d /s "path_to\7capture.exe"

Where:

-h: If the target system is Vista or higher, has the process run with the account's elevated token, if available.

-x: Display the UI on the Winlogon secure desktop (local system only).

-d: Don't wait for process to terminate (non-interactive).

-s: Run the remote process in the System account.

4) Open the Windows Secure Desktop you want to take a shot. (UAC Prompt, Ctrl+Alt+Del screen etc.)

5) Use Ctrl+PrintScreen to take a shot of just one window, or PrintScreen to take a shot of the entire screen.

6) Use Alt+Tab to switch to the 7capture.

7) Just save the file where you want. (If you have problems with the fullscreen image, just save it as BMP)

And here you can see the results on my Windows 7 (Brazilian portuguese language):

-
This method doesn't work if no user is logged in. –  and31415 May 26 at 8:06

# Take screenshots anywhere

The secure desktop is active whenever any of the following occur: the user locks their desktop (Windows+L), the screen saver activates (when no user is logged in), or by default when User Account Control presents a prompt.

Source: XPDM vs. WDDM

The idea is borrowed from William Hilsum's answer, but there's a difference: you don't need to replace any system file, and it's easier to undo the changes. After following the steps below, press Win+U whenever you need to take a screenshot of the secure desktop.

## Override the Ease of Access utility

1. Open a command prompt as administrator.
2. Type or paste the following command, and replace X:\Path\to\file.exe with the actual path of the screen capturing tool executable of your choice. Then press Enter.

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /v "Debugger" /t REG_SZ /d "X:\Path\to\file.exe" /f


Note Paint and the built-in Snipping Tool can't be used: you'll need to rely on third-party programs. Working tools are e.g Lightshot, Greenshot, and ShareX.

## Revert back the changes

1. Open a command prompt as administrator.
2. Type or paste the following command, and press Enter:

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /f

-

I have been using Windows Vista SP2. I have not encountered such kind of restriction above. My print screen runs like a charm. You can not get rid of that unless disabling the UAC (*U*ser *A*ccount *C*ontroller). To do this, use msconfig.exe. Look up "disable UAC settings" such a thing there. Than install green shot; it is a useful program I think. I have been using this method without an hassle.

-
OP wants to take screenshot of secure desktop. Disabling UAC disables secure desktop, right? –  gronostaj Aug 7 '13 at 21:13