How to take a screenshot of Window's secure desktop?

I have found a rather "black hat" way of doing it...

When in a secure desktop, the accessibility tools still work just fine... so, I used my copy of FastStone Capture Portable, I went to c:\windows\system32 and renamed osk.exe to osk.exe.old and copied/renamed fscapture.exe from the Faststone directory to osk.exe inside the system32 directory.

I then went to a UAC prompt and pressed Win Key+U, and clicked on the "on screen keyboard" option.

And... FastStone Capture started, although it was just a trial... using it under this mode cannot access my license details.... I was able to take a picture just fine and save it... although, when I thought I was saving to my desktop, it actually went to c:\windows\syswow64\config\systemprofile\desktop... you learn something new every day!

Based on the above, I always thought that the UAC secure desktop was an elevated environment using your own credentials, but, I guess it is actually launched under the System user - so, Print Screen may actually work, it just isn't under the context of your user - with this in mind, if you were to use a copy of paint instead of Fast Stone Capture, take a screenshot then launch Paint through the On Screen Keyboard hack, it may just work the same!

edit --- update ---

Paint is out the window! Just tested my theory and it didn't work, I am not sure the exact reason, but, I am guessing if you use pretty much any screen capture tool and my method above, it should work.

Get a digital camera and take a picture of the screen.

However, my question remains: is there any way to get a screenshot of this desktop?

A process running as SYSTEM and installed in an appropriate location can bypass UIPI and get on to the Secure Desktop.

Leverage the existing programs that do this -- RealVNC (not the free edition, unfortunately) and UltraVNC for example.

Run the server on your PC and connect the client to it from another computer. Take a screenshot of the client window.

Although it's probably just as easy to take a picture of the screen.

There is an even better way. With the help of two free open source tools, Greenshot and Process Hacker, you will be able to create a screenshot of the secure desktop with these benefits:

• No fiddling and no systemfile or registry changes required
• You don't need to type anything into a command prompt (for mouse users it's a benefit)

• It's easier to execute and, besides the first setup, a lot less time consuming. Let's start!

  1. Download Greenshot and configure the settings so it will autosave a picture of the whole screen to a folder if you're pressing the Print Screen key.

  2. Download Process Hacker. If you see the main window of Process Hacker, make sure Greenshot is closed and click on "Hacker" and "Run as..."

     

  3. Select the executable file of Greenshot in "Program". At "User name", click the list and choose "NT AUTHORITY\SYSTEM". "Type" should be Service, Session ID 1 and at "Desktop" select "WinSta0\Winlogon". This is important!

     

  4. Now you should be already good to go, click "OK", when Greenshot has finished loading (should be short), open an UAC window and press the Print Key. You should now see a picture of the secure desktop in your specified folder in Greenshot! If you don't need to create UAC screenshots anymore, simply kill the Greenshot process.

     

Have fun! I have confirmed and tested this by myself after several tests, because I haven't liked the solutions here so far.