Pressing Alt+Tab will switch out of the application, also. Ctrl+Esc is an alternate shortcut for opening the Start menu. Alt+Esc flips between running applications. There a number of different key sequences that can do this; a natural consequence of Windows being a multitasking operating system.
To work around this, you're going to have to install a low-level keyboard hook that can trap these task keys. The hook will watch for any of the common key sequences used to switch tasks. Whenever it detects one of those sequences, it will ignore the input by not passing it down the hook chain. Paul DiLascia wrote an article that addresses this very question in the September 2002 edition of MSDN Magazine. The part you care about starts about halfway down the page, but I've reprinted it here for convenience and to get the pleasures of syntax highlighting:
TaskKeyHook.h:
////////////////////////////////////////////////////////////////
// MSDN Magazine — September 2002
// If this code works, it was written by Paul DiLascia.
// If not, I don't know who wrote it.
// Compiles with Visual Studio 6.0 and Visual Studio .NET on Windows XP.
//
#define DLLIMPORT __declspec(dllimport)
DLLIMPORT BOOL DisableTaskKeys(BOOL bEnable, BOOL bBeep);
DLLIMPORT BOOL AreTaskKeysDisabled();
TaskKeyHook.cpp
////////////////////////////////////////////////////////////////
// MSDN Magazine — September 2002
// If this code works, it was written by Paul DiLascia.
// If not, I don't know who wrote it.
// Compiles with Visual Studio 6.0 and Visual Studio .NET on Windows XP.
//
// This file implements the low-level keyboard hook that traps the task
// keys.
//
#define _WIN32_WINNT 0x0500 // for KBDLLHOOKSTRUCT
#include <afxwin.h> // MFC core and standard components
#define DLLEXPORT __declspec(dllexport)
//////////////////
// App (DLL) object
//
class CTaskKeyHookDll : public CWinApp {
public:
CTaskKeyHookDll() { }
~CTaskKeyHookDll() { }
} MyDll;
////////////////
// The section is SHARED among all instances of this DLL.
// A low-level keyboard hook is always a system-wide hook.
//
#pragma data_seg (".mydata")
HHOOK g_hHookKbdLL = NULL; // hook handle
BOOL g_bBeep = FALSE; // beep on illegal key
#pragma data_seg ()
#pragma comment(linker, "/SECTION:.mydata,RWS") // tell linker: make it
// shared
/////////////////
// Low-level keyboard hook:
// Trap task-switching keys by returning without passing along.
//
LRESULT CALLBACK MyTaskKeyHookLL(int nCode, WPARAM wp, LPARAM lp)
{
KBDLLHOOKSTRUCT *pkh = (KBDLLHOOKSTRUCT *) lp;
if (nCode==HC_ACTION) {
BOOL bCtrlKeyDown =
GetAsyncKeyState(VK_CONTROL)>>((sizeof(SHORT) * 8) - 1);
if ((pkh->vkCode==VK_ESCAPE && bCtrlKeyDown) || // Ctrl+Esc
// Alt+TAB
(pkh->vkCode==VK_TAB && pkh->flags & LLKHF_ALTDOWN) ||
// Alt+Esc
(pkh->vkCode==VK_ESCAPE && pkh->flags & LLKHF_ALTDOWN)||
(pkh->vkCode==VK_LWIN || pkh->vkCode==VK_RWIN)) { // Start Menu
if (g_bBeep && (wp==WM_SYSKEYDOWN||wp==WM_KEYDOWN))
MessageBeep(0); // only beep on downstroke if requested
return 1; // gobble it: go directly to jail, do not pass go
}
}
return CallNextHookEx(g_hHookKbdLL, nCode, wp, lp);
}
//////////////////
// Are task keys disabled—ie, is hook installed?
// Note: This assumes there's no other hook that does the same thing!
//
DLLEXPORT BOOL AreTaskKeysDisabled()
{
return g_hHookKbdLL != NULL;
}
//////////////////
// Disable task keys: install low-level kbd hook.
// Return whether currently disabled or not.
//
DLLEXPORT BOOL DisableTaskKeys(BOOL bDisable, BOOL bBeep)
{
if (bDisable) {
if (!g_hHookKbdLL) {
g_hHookKbdLL = SetWindowsHookEx(WH_KEYBOARD_LL,
MyTaskKeyHookLL, MyDll.m_hInstance, 0);
}
} else if (g_hHookKbdLL != NULL) {
UnhookWindowsHookEx(g_hHookKbdLL);
g_hHookKbdLL = NULL;
}
g_bBeep = bBeep;
return AreTaskKeysDisabled();
}
He also provides sample code to disable the taskbar (thus preventing the Windows key from showing the Start menu) and a complete sample application that uses these libraries.
As far as preventing Ctrl+Alt+Del (the secure attention sequence, or SAS), the above approach is not going to work. The reason is that the OS traps the hardware interrupt generated by the SAS separately from other keys, specifically to prevent programs from hooking the sequence and spoofing a login prompt. You aren't going to be able to disable this feature with a keyboard hook. The article I linked to above does cover this requirement in great detail at the top portion, but those strategies are only tested and more than likely will only work on Windows XP. Another approach suggested by the article is to disable the Task Manager, but note that that won't stop the user from shutting down the system, etc. The right way to do this is to write a keyboard driver.
