I can name hundreds of occasions from first-hand experience where it hasn't worked in the past 26 years for me on a variety of machines in various environments.
One prominent example I've seen multiple times, is hanging in the shutdown screen where no text appears under the spinning dots, and Ctrl-Alt-Del does nothing.
Ctrl+Alt+Del invokes WinLogon, the highest priority process, that then delivers the task manager. I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work. Tthis is possibly attributable as much to convenience as it is to security -- the Secure Attention Sequence[1] is intended as a login-spoofind protection which will suspend other tasks (like a spoofed login screen) before continuing forward with user auth.
A group policy can be enabled on most variants of Windows (dating back to around NT 4 or Windows 2000, I think) to start with a dialog saying "Press Ctrl-Alt-Delete to begin", and pretty much nothing else, exactly for the reasons you describe.
Though Microsoft's current security recommendation is against setting that policy for accessibility reasons. [0]
Windows since 8 has worked on hardening/strengthening the "Secure Desktop" that login flows (and UAC prompts) happen on so that as much as possible malware shouldn't be able to run in those sandboxes.
> I believe this is a kernel invocation, so regardless of user land dysfunction, it will always work.
It may always work from the kernel's standpoint, but this doesn't necessarily make it usable.
Anything that blocks the display of WinLogon (e.g., the GPU has crashed and is unresponsive) would render this emergency restart mechanism unusable, and typically, situations like this are usually the only time I would need such a feature.
I had a situation a month ago where my computer froze up (it was a couple months old at the time) and literally nothing would respond, even control-alt-delete, but my mouse cursor would still move around. I have no idea what caused that (it was a fresh restart after installing a GPU driver) but whatever drives the cursor display must be even higher priority than C-A-Del.
Most graphics cards implement a hardware mouse cursor where the video card reads the current pointer location from memory and overlays the cursor on the screen. So I guess if the driver for the mouse and the video driver are both still running (the kernel hasn’t stopped completely) that will still work even if Winlogin is screwed to the point where it can’t show the CTRL-ALT-DEL screen.
Happy to be corrected by someone who knows more about the windows kernel. :)
Interesting I didn’t know that. Some part of the kernel was fucked for sure as even the hardware sleep button in my keyboard didn’t work but I guess if the display driver was functioning that would be all that was needed.
I feel like it worked more reliably in XP and below, ever since vista I’ve had less success.
With that said, system stability as a whole seems to have improved dramatically since those days, I don’t need to reach for it very often.
