How to disable Logoff from Ctrl+Alt+Del via Group Policy

How to disable Logoff from Ctrl+Alt+Del via Group Policy in Windows Server 2012 R2

In this post, we will learn the steps to disable Logoff from the Ctrl+Alt+Del options via group policies in Windows Server 2012 R2. Using this policy, we’ll restrict the users from Log off when they press Ctrl+Alt+Del from their keyboard. This will prevent the users from logging off using this option. They can either shutdown, restart or log off from the start menu only.

Pre-requisite:
– On the Domain Controller, create an Organizational Unit and then create some users in the same OU. For this practical, we have created Finance OU and created some users in that.
– A client computer is required to check if the GPO to disable logoff from Ctrl+Alt+Del is working successfully or not.

How to promote Domain Controller

Before we deploy the policy to disable logoff from Ctrl+Alt+Del option, login on the client computer with the Domain user and then press Ctrl+Alt+Del, to check the options that Domain Users can see. In this practical, user can see options like Lock this computer, Switch User, Log off, Change a password and Start Task Manager.

Option “Lock this computer” would lock the computers. Option “Switch User” would switch the user and allows you to login with another User. Option “Log Off” would allow the user to Log off from the Computer. Option “Change a password” would allow user to change the current password. Option “Start Task Manager” would allow to run the task manager. 

Steps to disable Logoff from Ctrl+Alt+Del via Group Policy in Windows Server 2012 R2

1. On Domain Controller (DC), in Active Directory Users and Computers, we have created an OU naming “Finance” and added some users in the OU.

How to create Organizational Units in Active Directory

2. Open Group Policy Management Console (GPMC), and right click on “Finance” and then click on “Create a GPO in this domain, and Link it here“.

3. On New GPO console, enter the name of the group policy object. In this practical, the name of our GPO is “Remove Logoff from Ctrl+Alt+Del“. Click on Ok. It will create a blank GPO and link it with the domain.

4. On GPMC, right-click on the GPO and click on “Edit“. We would edit the default blank GPO to define the settings required.

5. On Group Policy Management Editor (GPME) console, under User Configuration expand Policies then expand Administrative Templates. Under Administrative Templates expand System and click on “Ctrl+Alt+Del Options“. On the right hand side, we can see options like “Remove Change Password”, “Remove Lock Computer”, “Remove Task Manager” and “Remove Logoff”. Double click on “Remove Logoff” to modify the settings of this policy.

6. On Remove Logoff console, select “Enabled” to enable this policy. Click on Apply and Ok. Enabling this policy would remove Logoff from the Ctrl+Alt+Del Options menu.

7. Login on a client computer with any domain user account added in the OU “Finance” and press “Ctrl+Alt+Del”. We can verify that the option of Log off is removed and this policy is successfully deployed.

Similarly, you can deploy all other options that are defined in the above mentioned step number 5 like “Remove Change Password”, “Remove Lock Computer” and “Remove Task Manager”.

Note: This policy would only disable logoff from Ctrl+Alt+Del, user can still log off computer by typing Logoff in the run or in command prompt.