Sending Ctrl+Alt+Del (SAS) Command Line VNCViewer.exe

[jpickerell]

First, thanks for such a great product!!!!!

Any chance of adding a command line option to the vncviewer.exe process to send Ctrl+Alt+Del (or whatever the SAS equivalent that UltraVNC is using behind the scenes)? For scripting purposes, you would want the ability to send Ctrl+Alt+Del without a any GUI/VNCViewer window appearing. The functionality is already in the viewer and server but not exposed to command line input as far as I can tell. This would open up quite a few new use cases for myself (and many others I would think).

I use UltraVNC almost exclusively (VNCServer running as service on every machine in the school district that I manage) and somewhat frequently deal with an entire room or lab of computers at once (either in person or remotely). A use case is getting a lab pre-logged in and ready for computerized testing. We have various generic shared-use logins that are used for specific testing scenarios. That login might be locked down to only run that specific testing app and in many cases, it is preferred to already have this account logged in ahead of time with testing app ready to go when students walk in (or even used with mobile labs in the classroom). This can make for a much more productive experience (for testing coordinator or teacher but also the students) as one less thing to worry about interfering with the testing experience. It is also a time-saver. We might also use it when doing a manual update to a group of machines (non-scripted task) and want to pre-log them all in as an administrative user or specific shared use login.

I can bulk reboot, bulk log out, but not bulk log in machines. I think that if I could command-line script the the Ctrl+Alt+Del (or equivalent SAS function), that I could script the remaining keystrokes needed (with something like AutoHotKey) to interactive log in to the machines. This would be HUGE!!!!!!!!!!! I can't understate this, something I have been trying to figure out for quite a few years! Why I never thought of doing it through UltraVNC built-in functionality, I don't know!


On side note, think I'll post another separate feature request to actually add a remote interactive login/authentication to the windows login screen (and if doing so, a command line way of doing it as well!) but that would be quite a bit more work I would think to program (so starting with the above request as the base functionality is already there and would be MUCH easier to add I would guess). (And even if a remote interactive login function was added, having the above command-line interface to send Ctrl+Alt+Del would still be desired as a stand-alone feature!) And why do I even think it is possible to remotely push/script a Windows Interactive Logon? Good question! I have seen LogMeIn do it.

I have a limited free LogMeIn account that I use from time-to-time for a couple of situations and after I authenticate, start a remote control session, and send the Ctrl+Alt+Del, a prompt appears asking if I want LogMeIn to "initiate a login to account DomainOrComputerName\Username without you having to type in password". The LogMeIn client is securely caching or otherwise saving my credentials (when Automatic Authentication option is turned on to allow this) to pass on to the login session. They call this "Automatic Authentication". It's not autokeying function typing of username and password. It is passing it through using some other unknown-to-me Windows API as far as I can tell. It works whether I have a locked Windows session requiring password (or username and password), am at the classic username and password initial login screen, or or provided a list of user names or last logged in user and "Other User" icons. Their "LogMeIn Central Premier subscription" users seem to be able to save Host Login Credentials for any of the hosts you have saved in their management system.

I wouldn't ask UltraVNC to necessarily store these credentials That's probably not a job we want to ask a freely provided (but fantastically wonderful!!!), understaffed (thank you Rudi for the enormous time and effort donated to this project!!!!!) project to undertake (at least to start ). I'd say (that if undertaken) you could leave that task to the users to do or not. If command-line functionality was provided to use this function, we could pass username and password in as parameters.

Remote interactive login functionality would be good to have both with command-line with no GUI response (scripting or 3rd party usage, that would be the priority functionality to me) and GUI Interactively. For GUI, a use case might be command-line script the username/password to login and open Viewer (or open the viewer and remote login is occurring concomitantly) to show the session. A second use case might be, open the viewer GUI (no command-line); have username, password, and domain optional connection fields; and when hit connect, it uses those to pass through to either log in remotely with viewer remote display (as viewer currently works, but with automatic remote console/desktop authentication), or as just a utility to remotely log in a single machine with no viewer remote display visible (say you need to log on with a specific account for someone at a remote machine so that they can perform a task on-sight but don't have the needed credential). Ohhhh, this is getting exciting and and opening up all kinds of exiting possibilities!!!!!!

And.... I should have just split the entire second half of this post into a separate posting (as the first part would be HUGELY beneficial and desired on it's own (but much simpler than the second part)!!!!!)

Jared

[Rudi De Vos]

Long post...took some time to read.

Ultravnc is already complex, something like this should be in a seperate little service in combination with a client cmd app.
So you could use it in scripts
like
remoteconsoledesktop ipaddress logoff
remoteconsoledesktop ipaddress logoff thisuser
remoteconsoledesktop ipaddress logon user passwd

The logon isn't simple, there is no API for it, and using keypresses ( user tab passwd enter) doesn't work in all cases.
Gina dll injection and credential providers could be a solution, but that's nasty stuff and could cause potential security
issue's. The only API that exist is to switch between existing users, not to create a session.

[jpickerell]

Rudi,

Thanks for reading (and sorry for such a long post, I can be too wordy)! How would you feel about adding the command-line ability of sending Ctrl+Alt+Del? Even if remote sending of keypresses doesn't work in all cases (would be responsibility of us end-users to come up with something that works for our particular cases after the Ctrl+Alt+Del is sent), adding that capability to the vncviewer.exe (or a separate client EXE that talks to the UVNC server), would be a huge benefit in working with my school lab computers. And was thinking (hoping anyway) that adding that functionality would be fairly simple???

As far as the remote logging in (or logging off as you added), separating out (either just client-side or both client side AND server service) would be great as far as I'm concerned. The example syntax you gave would be exactly the type of functionality that would save so much manual time for our teachers, test coordinators, and in misc tech situations. I'm a sysadmin that doesn't have a clue when in comes to programming so I don't know how LogMeIn is doing it, and I'm sure they wouldn't be any too quick to tell anyone how they are doing it either. I haven't seen it work personally, but "AB Tutor" and "NetSupport School" (paid products that do much more but are probably out of our price range) also claim to both be able to do remote logons. If we could figure this one out, it would be HUGE!!!!

[Rudi De Vos]

I have been playing with snippets, lots of time has i'm current looking for a new daytime job.

student pc, uvnc_cmd service
teacher uvnc_cmd.exe ( commandline)

*single signon: teacher need to be admin on student pc's
*all data between teacher and student pc are encrypted ( from the moment you use passwords, encryption is needed)
options:

Code: Select all

Usage:
[-debug]-ctrlaltdel server (send ctrl alt del) 
[-debug]-logoff server (logoff current user)
[-debug]-lock server (lock desktop current user)
[-debug]-reboot server (reboot system)
[-debug]-udp user domain password server (reboot system and logon as user) 

Logon without reboot is to complex: different for all OS's and gina or security providers
The trick is to use the registry autologon parameters,
-user
-domain
-autologon
Passwd is saved using the MS buildin encryption, not readable from registry
The autologon is only one time active, if you reboot again the autologon is disabled.

[jpickerell]

Missed the notification that you had responded, apologies for the late response! I'm liking what I'm seeing!!! (not the part about not having a day job though, good luck on the hunt!) Really appreciate you taking some of your valuable time to work on! I'd love to be able to figure out how other 3rd party's (such as LogMeIn) do the remote logon, but not something we will probably be able to figure out easily any time too soon. I think your setting of autologin and rebooting is workable. It would be great then, if on reboot and after that initial autologin, that the service sets the autologon registry entries back to their previous state?

Have been super busy at work trying to get several new/updated Windows 7 and Windows 10 images done to roll out to our various student computers, but if you need someone else to test out the new service/uvnc_cmd.exe, let me know.

[Rudi De Vos]

Already have a new job
The remote logon is only possible by replacing the gina.dll or adding some credential provider ( like a smart card, but some virtual card with remote provided data). To complex and require a lot of security testing.
Autologon exist on all OS's, passwd is OS encrypted and you already have a buildin counter that makes it possible that the autologon is only executed onces and reset. All is buildin by MS and you can activate it by writing to the registry... clear simple and secure.

I mailed you the test EXE, service and teacher cli part. It's working on my system but the "Single Signon" require a better test.
( was mailed 21 Jul as "test bins")

[jpickerell]

Congrats!!! Didn't take long at all! Email didn't come through so thanking maybe spam filter caught it??? Sent my work email address to you in an email if you wouldn't mind trying to send it that way. VERY much appreciated!