LabVIEW
Using windows operating system for automation application with Labview
Safety concerns aside, which you should definitely not dismiss but investigate very thoroughly, there are actually ways to make Windows startup any executable on launch instead of explorer.exe. How much control this program will give to the user is then mainly defined by that program alone.
This key defines what Windows will startup after the current user logs on:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
By adding such a key to a HKEY_LOCALE_MACHINE hive too, you can overwrite what any user will see when logging on unless there is a specific key in his user account.
It's a good idea to at least have one user with admin rights on the system that simply starts up the explorer.exe file. This will let you get in the machine and do some maintenance even if you brick the other accounts.
But Ctrl-Del is not so easy to get blocked, that needs some specific Windows API calls, and you really can lock out a system with these things that it is very hard to get into it for maintenance and such anymore.
If you add that key to HKLM or HKCU or any other specific user registry hive will determine when this change happens.
Basically the executable defined here will be started by the Windows logon shell as soon as a user logs on the system. And this program gets control of everything. If this is not defined or points to an invalid executable, the logon shell will resolve to startup explorer.exe.
And if explorer.exe is not started, any shortcuts and other things explorer normally intercepts and acts on will simply not be handled, unless your program handles them. Ctrl-Alt-Del however is not an explorer shortcut but is handled deep down in the Windows kernel together with one or two other similar shortcuts. So it will still be available but if you have no keyboard you should be fine with these. However you definitely should plan some way to get out of this somewhere. The few times I locked down a machine like this (based on requirements from the client) I always had a password secured button somewhere that would allow to enter a special screen where one could have the registry key reset to its default value as well as launch Task Manager and/or Explorer.
And I know of at least one case where the customer eventually required this to be completely disabled as they found it to cumbersome to maintain their PCs since they were really locked out from anything as I had also disabled Ctrl-Alt-Del (on their request in the requirements specification). A typical case of think not only twice but at least three times about what you wish when making a software requirements specification. 😁
Needless to say that testing that application was a real pitta, even with secret application shortcuts to enable and disable that security lockout.
