26

By default, Windows Vista/7/8's UAC prompt is shown on a secure desktop. Unfortunately the Print Screen key doesn't seem to have any effect when viewing the secure desktop. I can see the reasoning behind this - no user-mode application should be able to capture the contents of the secure desktop.

However, my question remains: is there any way to get a screenshot of this desktop?


Edit: perhaps it would help if I explain the problem.

I am currently running Windows 8 and I have a small DisplayLink-based monitor that I would like to use. This driver was just released and works great - except it breaks on the secure desktop. I want to post a bug report on the forums there and in order to do so, I'd need a screenshot. Obviously the problem won't manifest itself on the standard desktop - and running Windows in a VM is impossible because Windows 8 requires hardware virtualization (which I don't have) and getting USB monitors to work with a VM is tricky at best anyway.

6
  • 5
    You can run it in a virtual machine.
    – jdigital
    Jan 27, 2012 at 0:35
  • 1
    @user8368: That's not an option since I'm trying to get the screenshot to demonstrate a particular hardware problem that may not show up in a VM. It's also not an option from a licensing perspective. And lastly, I don't have hardware virtualization, so it would make the whole thing very difficult. Jan 27, 2012 at 0:41
  • 1
    You can set the UAC prompt to not use the secure desktop through (Local) Group Policy.
    – billc.cn
    Jan 27, 2012 at 0:42
  • 1
    @billc.cn: I know, but then the problem that I'm trying to get a screenshot of won't manifest itself. Jan 27, 2012 at 0:44
  • 1
    @GeorgeEdison: Are you sure? By turning off the Secure Desktop, the UAC prompt will still fire. But since it isn't on the secure desktop, other applications can screenshot it.
    – surfasb
    Jan 27, 2012 at 1:05

11 Answers 11

40

I have found a rather "black hat" way of doing it...

enter image description here

When in a secure desktop, the accessibility tools still work just fine... so, I used my copy of FastStone Capture Portable, I went to c:\windows\system32 and renamed osk.exe to osk.exe.old and copied/renamed fscapture.exe from the Faststone directory to osk.exe inside the system32 directory.

I then went to a UAC prompt and pressed Win Key+U, and clicked on the "on screen keyboard" option.

And... FastStone Capture started, although it was just a trial... using it under this mode cannot access my license details.... I was able to take a picture just fine and save it... although, when I thought I was saving to my desktop, it actually went to c:\windows\syswow64\config\systemprofile\desktop... you learn something new every day!

Based on the above, I always thought that the UAC secure desktop was an elevated environment using your own credentials, but, I guess it is actually launched under the System user - so, Print Screen may actually work, it just isn't under the context of your user - with this in mind, if you were to use a copy of paint instead of Fast Stone Capture, take a screenshot then launch Paint through the On Screen Keyboard hack, it may just work the same!

edit --- update ---

Paint is out the window! Just tested my theory and it didn't work, I am not sure the exact reason, but, I am guessing if you use pretty much any screen capture tool and my method above, it should work.

5
  • 3
    This is a very clever use of the accessibility tools :) Jan 27, 2012 at 2:47
  • 2
    I suspect Paint doesn't ask for UIAccess permissions to play nice with UIPI, whereas the other accessibility applications do. See UIAccess for UI automation applications over here for the requirements. Jan 27, 2012 at 3:17
  • @todda.speot.is Interesting and will read as I am interested to learn, but, I think there may be more to it as well - I can't imagine Faststone Capture implementing this, it must be that print screen is simply disabled by default and most screen capture utilities just override default behaviour... (I know MS has the technology to disable bits - e.g. MS DRM enterprise suite (forget real name) disables print screen and many other features). Jan 27, 2012 at 9:33
  • @WilliamHilsum (in reference to your previous comment): Are you referring to Group Policy?
    – bwDraco
    Oct 7, 2012 at 1:25
  • I wonder if the Snipping Tool would do the same? Jun 9, 2017 at 19:07
19

Get a digital camera and take a picture of the screen.

1
  • This also came to mind for me as well. Not as elegant but much less of a headache. Jan 27, 2012 at 4:13
17

However, my question remains: is there any way to get a screenshot of this desktop?

A process running as SYSTEM and installed in an appropriate location can bypass UIPI and get on to the Secure Desktop.

Leverage the existing programs that do this -- RealVNC (not the free edition, unfortunately) and UltraVNC for example.

Run the server on your PC and connect the client to it from another computer. Take a screenshot of the client window.

Although it's probably just as easy to take a picture of the screen.

1
  • 1
    Oh that's right... I have another machine I can VNC to and see the secure desktop - I totally forgot about that. Jan 27, 2012 at 2:40
13

There is an even better way. With the help of two free open source tools, Greenshot and Process Hacker, you will be able to create a screenshot of the secure desktop with these benefits:

  • No fiddling and no systemfile or registry changes required
  • You don't need to type anything into a command prompt (for mouse users it's a benefit)
  • It's easier to execute and, besides the first setup, a lot less time consuming. Let's start!

    1. Download Greenshot and configure the settings so it will autosave a picture of the whole screen to a folder if you're pressing the Print Screen key.

    2. Download Process Hacker. If you see the main window of Process Hacker, make sure Greenshot is closed and click on "Hacker" and "Run as..."

    3. Select the executable file of Greenshot in "Program". At "User name", click the list and choose "NT AUTHORITY\SYSTEM". "Type" should be Service, Session ID 1 and at "Desktop" select "WinSta0\Winlogon". This is important!

    4. Now you should be already good to go, click "OK", when Greenshot has finished loading (should be short), open an UAC window and press the Print Key. You should now see a picture of the secure desktop in your specified folder in Greenshot! If you don't need to create UAC screenshots anymore, simply kill the Greenshot process.

Have fun! I have confirmed and tested this by myself after several tests, because I haven't liked the solutions here so far.

1
  • Work like a charm. More details are: 1) in step 3, AT FIRST, you need to run greenshot once with desktop "WinSta0\Default", to set output destination and capturing action settings. Because there is no ui to operate when desktop set to "WinSta0\Winlogon" 2) destination can only be set to root dir, e.g. "C:\".
    – Sender
    May 20, 2023 at 2:59
5

I will offer another option than use virtual machine, vnc or changing registry or system files which maybe be nasty or impossible in some cases.

First you will need a screenshot software, for this answer I will use 7capture which is free, but I believe that can be done with others softwares.

Second you will need PsExec from PsTools suite, that tool will enable to put 7capture inside the Windows Secure Desktop, without changing any system files, just creating and removing a service which is automatically done by PsExec.

Then with the 7capture installed and with PsTools extracted to some folder do the following:

1) Open CMD as admin.

2) Set the current folder to the folder where PSTools was extracted: cd path_to\PSTools

3) Start 7capture inside the Windows Secure Desktop with the following command: PsExec /h /x /d /s "path_to\7capture.exe"

Where:

-h: If the target system is Vista or higher, has the process run with the account's elevated token, if available.

-x: Display the UI on the Winlogon secure desktop (local system only).

-d: Don't wait for process to terminate (non-interactive).

-s: Run the remote process in the System account.

4) Open the Windows Secure Desktop you want to take a shot. (UAC Prompt, Ctrl+Alt+Del screen etc.)

5) Use Ctrl+PrintScreen to take a shot of just one window, or PrintScreen to take a shot of the entire screen.

6) Use Alt+Tab to switch to the 7capture.

7) Just save the file where you want. (If you have problems with the fullscreen image, just save it as BMP)

And here you can see the results on my Windows 7 (Brazilian portuguese language):

UAC Prompt window UAC Prompt full screen

1
  • This method doesn't work if no user is logged in.
    – and31415
    May 26, 2014 at 8:06
2

If you install TeamViewer on your pc, and you have rebooted your pc, teamviewer will then be able to access the UAC prompt. From another pc that is using teamviewer, you can make a screenshot of your whole desktop while teamviewer is visible but does not have focus, and you'll have a screenshot of the UAC prompt.

2

Another option is to use autoitscript (from autoitscript.com)

It's a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation.

With send() function you can simulate the printscreen keypress. Taken from on site examples https://www.autoitscript.com/autoit3/docs/functions/Send.htm:

Example()

     Func Example()
          Send("{PRINTSCREEN}")
     EndFunc

Go here http://www.autoitscript.com/site/autoit/downloads/ to download it.

I haven't tried this solution myself but seems pretty decent given that you need to hack around to solve your issue.

Give it a try. Hope I helped.

2

Take screenshots anywhere

The secure desktop is active whenever any of the following occur: the user locks their desktop (Windows+L), the screen saver activates (when no user is logged in), or by default when User Account Control presents a prompt.

Source: XPDM vs. WDDM

The idea is borrowed from William Hilsum's answer, but there's a difference: you don't need to replace any system file, and it's easier to undo the changes. After following the steps below, press Win+U whenever you need to take a screenshot of the secure desktop.

Override the Ease of Access utility

  1. Open a command prompt as administrator.
  2. Type or paste the following command, and replace X:\Path\to\file.exe with the actual path of the screen capturing tool executable of your choice. Then press Enter.

    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /v "Debugger" /t REG_SZ /d "X:\Path\to\file.exe" /f
    

    Note Paint and the built-in Snipping Tool can't be used: you'll need to rely on third-party programs. Working tools are e.g Lightshot, Greenshot, and ShareX.

Revert back the changes

  1. Open a command prompt as administrator.
  2. Type or paste the following command, and press Enter:

    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe" /f
    
1

I do not know much about secure desktop, but you could, in theory, be able to open Snipping Tool and use it to take a screenshot that way. No registry editing, no file renaming, none. This is very basic and easy method. Either search for "Snipping Tool" or open Run (keyboard shortcut: Win+R) and type "snippingtool" or "snippingtool.exe".

Either way, open it and use the "Full-screen snip" mode. In Windows 10, click the arrow next to the "Mode" button and select "Full-screen snip". In older Windows versions, click the arrow next to the "New" button and select "Full-screen snip". This is automatically copied to the Snipping Tool window where you can add notes, save the snip, or email it from the Snipping Tool window. See Microsoft's help page for more information.

1

Disable secure desktop for UAC, by using following steps:

  1. Use the Windows key + R keyboard shortcut to open the Run command.
  2. Type gpedit.msc and click OK to open the Local Group Policy Editor.
  3. Browse the following path:

Computer Configuration > Windows Settings > Security Settings > Security Options

  1. On the right side, double-click the User Account Control: Switch to the secure desktop when prompting for elevation policy.

Local Group Policy Editor

Select the Disabled option.

enter image description here

  1. Click Apply.
  2. Click OK.

After that you can use normal print screen key on any elevated application.

-1

I have been using Windows Vista SP2. I have not encountered such kind of restriction above. My print screen runs like a charm. You can not get rid of that unless disabling the UAC (User Account Controller). To do this, use msconfig.exe. Look up "disable UAC settings" such a thing there. Than install green shot; it is a useful program I think. I have been using this method without an hassle.

1
  • OP wants to take screenshot of secure desktop. Disabling UAC disables secure desktop, right?
    – gronostaj
    Aug 7, 2013 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .