Groups > alt.comp.os.windows-10 > #182486

Re: Windows Spotlight shows picture information data on lock screen of one PC, but not others.

Path	csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	Frank Slootweg <this@ddress.is.invalid>
Newsgroups	alt.comp.os.windows-10
Subject	Re: Windows Spotlight shows picture information data on lock screen of one PC, but not others.
Date	22 Feb 2025 19:52:58 GMT
Organization	NOYB
Lines	57
Message-ID	<vpddef.ufg.1@ID-201911.user.individual.net> (permalink)
References	<vpctqt$1jqq$1@dont-email.me> <vpd8ad$3i85$1@dont-email.me>
X-Trace	individual.net I5Jwi2XR5/50HMONE/zK5AGwzExrYbk+mDL5xbJS2yiOG6tNRA
X-Orig-Path	not-for-mail
Cancel-Lock	sha1:F/pY62+Z37l/nHd5sAxRJ+g4ZkU= sha256:yF8j/5sTyEGVBFXsVZokmShH5KFr/xsEyZKHGVh6TG8=
User-Agent	tin/1.6.2-20030910 ("Pabbay") (UNIX) (CYGWIN_NT-10.0-WOW/2.8.0(0.309/5/3) (i686)) Hamster/2.0.2.2
Xref	csiph.com alt.comp.os.windows-10:182486

Show key headers only | View raw

Java Jive <java@evij.com.invalid> wrote:
[...]
> Nailed it.  For my builds, it's the following policy setting in 
> GPEdit.msc ...
> 
>      Computer Configuration
>      Windows Settings
>      Security Settings
>      Local Policies
>      Security Options
>      Interactive Logon: Do not require CTRL-ALT-DEL
> 
> ... which in my case was
> 
>      Disabled
> 
> ... meaning (after parsing out the confusing double negative) ...
> 
>      Require CTRL-ALT-DEL
> 
> Setting this to ...
> 
>      Enabled
> 
> ... meaning (after parsing out the confusing double negative) ...
> 
>      Do NOT require CTRL-ALT-DEL
> 
> ... allows the Spotlight icon ...
> 
>      Like what you see?
> 
> ... to appear on the lock screen.
> 
> As Paul suggests, this is, or at least used to be, something of a 
> security issue, as described here ...
> 
> https://www.manageengine.com/vulnerability-management/misconfiguration/logon-security/how-to-enable-secure-login-ctrl-alt-delete-logon-via-group-policy.html
> 
> ... and accordingly I've always previously disabled this policy on my 
> builds, so that <Ctrl-Alt-Delete> is required to log on.  How much of an 
> issue this is still, or whether more recent versions of Windows are more 
> secure against logon window spoofing rendering the policy redundant, I'm 
> no longer sufficiently in the know to be able to comment further.

  Be aware that 'Require CTRL-ALT-DEL' [1] might be turned on again
behind your back. At least that happened to me (on Windows 11) when I
(temporarily) set the lock screen timeout ('If you've been away, when
should Windows require you to sign in again?') to 'Never'.

  That seemed to be a temporary change, because after a reboot, 
CTRL-ALT-DEL was no longer needed to sign-in.

[1] There is an applet (netplwiz) where you can tick/untick 'Require
users to press Ctrl+Alt+Delete' ("Secure sign-in"), but (at least in my
experience) it doesn't work, i.e. after unticking the setting,
Ctrl+Alt+Delete is still required.

Thread

csiph-web