SEARCH

How-To Geek

How to Take Screenshots of the Windows Logon Screen: 2 Geeky Tricks

image

There are ways to run a screen capture utility – or any other program – from the welcome screen. Windows doesn’t make this easy, but it’s possible. The logon screen runs on the Winlogon desktop, an isolated Windows desktop.

Whether you’ve set a custom logon screen background and want to show it off, need a screenshot for your tutorial, or want to capture an error message, any of these methods will work for you.

Launch Programs on the Winlogon Desktop

We can launch other programs on the Winlogon desktop with the PsExec command, available on Microsoft’s website. The PsExec command is part of the Sysinternals suite of utilities.

After downloading the PSTools package, place the PsExec.exe command into your path – for example, in the C:\Windows\System32 directory.

image

Next, launch a Command Prompt as administrator by right-clicking the Command Prompt shortcut and selecting Run as administrator.

image

From the administrator Command Prompt, run the following command to launch a command prompt window on the Winlogon desktop:

psexec -sx cmd.exe

The s option tells psexec to launch the process as the system user account, while the x has it launch the process on the local Winlogon desktop.

image

Lock the screen with WinKey+L and press Alt-Tab to reveal the Command Prompt running on the Winlogon desktop. You’ll also see the command prompt if you press Ctrl-Alt-Delete and Alt-Tab on the Ctrl-Alt-Delete screen, which also runs on the Winlogon desktop.

image

Use the Command Prompt to launch screenshot utilities and other applications on the secure desktop.

Hijack the Ease of Access Button

Windows displays an Ease of Access button at the bottom left corner of the login screen. When clicked, this button opens the Utilman.exe program, allowing you to start accessibility utilities from the login screen. You can actually replace the Utilman.exe file with another EXE file – like a screenshot utility – to easily take a screenshot of the login screen.

You’ll find the Utilman.exe file in the %WINDIR%\System32 directory, which is C:\Windows\System32 by default.

image

We’ll need to rename the Utilman.exe file so we can replace it with another EXE file, but we can’t rename it until we take ownership of it. To take ownership of this file, right-click it and open its Properties window.

image

Select the Security tab in the Properties window and click the Advanced button to access its advanced settings.

image

Select the Owner tab in the Advanced Security Settings window and click the Edit button. I’ve already taken ownership of the file here – by default, it’s owned by TrustedInstaller.

image

Select your administrator account and click OK to take ownership.

image

After you’ve taken ownership of the file, you can rename it to something like Utilman_backup.exe

image

You’ll need a screenshot utility to put in Utilman.exe’s place. I tested Win 7 Logon Screen Capture, which worked well. Put the file in Utilman.exe’s place.

image

After it’s installed, go back to the logon screen (WinKey+L) and click the Utilman.exe file to take your screenshot. Clicking the button will bring up a save dialog if you’re using Win 7 Logon Screen Capture.

image

Use a Virtual Machine

Most screenshots of the Windows logon screen you see online were taken using virtual machine software. This is the simplest way to take these screenshots, as the virtual machine software displays the guest operating system’s logon screen in a window on your desktop.

To get started with virtual machines, check out our list of articles for learning virtual machines.

Chris Hoffman is a technology writer and all-around computer geek. He's as at home using the Linux terminal as he is digging into the Windows registry. Connect with him on Google+.

  • Published 05/6/12

Comments (15)

  1. vistual

    cool tip Chris!
    have seen people asking about this in the forums. will make sure to pass it along.

  2. Lee

    Taking the “Hijack the Ease of Access Button” further, you might be able to replace it with a batch file (or a batch file converted into an exe) to get a command prompt. Then you wouldn’t lose the accessibility features and you could even customize it with a menu of options and such.
    I’ll try this out and comment back.

  3. Hariks

    Lock the screen with Win+L and press Printscreen…
    Login back and paste to Paint. The screenshot is ready…

  4. john

    @Hariks: by default, Windows can’t do that

  5. Brian

    Why, that’s ingenious, my good man. Pip pip!

  6. PCFreak

    For this purpose there is no need to replace utilman.exe. Just add the following registry key to permanently replace utilman.exe with cmd.exe

    “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Utilman.exe”
    REG_SZ Debugger value cmd.exe

    This is easily done and easily removed.

    See also the blog entry here: http://blog.pcfreak.de/2012/02/08/most-sophisticated-utilman-exploit-for-teensy-and-other-hid-emulators/

    much more convenient…

  7. tom

    Or you know you can just screenshot a VM in half that time.

  8. Atlcr

    @Lee, looking forward to that batch file! :)

    @Chris Hoffman, Great tutorial! It really filled my Geek quota for the day. :D

  9. Jo

    Good tips, thanks for this

  10. Fred Nerk

    Too messy, try using a camera.

  11. Chris Hoffman

    @PCFreak

    Wow, thanks for the tip! That’s a lot more convenient. I had no idea such a registry value even existed.

  12. Wut

    Wait, I know this is totally off topic and such, but Chris Hoffman? From Nintendo Power? I have renewed respect for you sir.

  13. Chris Hoffman

    @Wut

    Nope, I’ve never been involved with Nintendo Power — I remember it being a magazine when I was a kid, though.

    “Chris Hoffman” is a pretty common name, unfortunately.

  14. Sammy Finn

    Hi Chris~
    i cannot save the logon screen.bmp in my hardisk~
    even i saved one times but i still cannot find my bmp file ~

    what happen ?

    help me please ~~~

    thanks

  15. Chris Hoffman

    @Sammy Finn

    Not sure — keep track of where you save it to. It might save in a weird directory by default, like C:\

Get Free Articles in Your Inbox!

Join 134,000 newsletter readers

Email:

Go check your email!