NOLOCKWS, version 0.99 beta, February 1998

A program to modify msgina.dll in order to inactivate the Lock Workstation button in the Windows NT Security (Ctrl-Alt-Del) dialog.

Copyright (C) 1997 by

This program is free software under the GNU General Public License. See the file LICENSE for details. The latest version of NOLOCKWS can be found at http://wwwthep.physik.uni-mainz.de/~frink/nt.html.

Contents

1. Introduction
2. Legal stuff
3. Concept
4. Usage
5. Implemented and tested platforms
6. Files
7. Feedback/possible improvements

1. Introduction

Especially for large PC pools in universities or schools it is very annoying when users lock their NT workstations, leave, and forget to come back. Subsequent users have the choice of resetting the PC or calling an administrator who can unlock the workstation. While lots of Windows NT settings can be changed through the registry, disabling the Lock Workstation button in the Windows NT Security (Ctrl-Alt-Del) dialog seems to be forgotten.

Some time ago, I suggested a method how to overcome this: load msgina.dll from the \winnt\system32 directory with a resource editor (which come with most C++ compilers for Windows) and modify the window style attributes of the Lock Workstation button in dialog #1000 or #1650 (this is the Windows NT Security dialog) for NT 3.51 or 4.0 resp.

However, this is cumbersome, dangerous (a corrupt msgina.dll may prevent the system from booting properly), and not everybody has a resource compiler to hand. Therefore I decided to write a program that automates this task. This is the second BETA version intended for a broader testing than I can do.

Warning!

2. Legal stuff

For short, the main aspects of the GNU General Public License are in my personal interpretation which may not be 100% accurate (I am a physicist, not a lawyer):

• Everybody (private or commercial users) can use this program freely. However, there is no warranty of any kind, since this is free software. Use it at your own risk!
• Everybody may copy and distribute it, as long as you include the copyright notice, a disclaimer of warranty, the GNU License, and the source code (or make it freely available).
• You may modify the program or use parts of it in own programs, as long as you distribute it under this license as well (included, but not limited to making the source code available). Further include appropriate copyright notices and take responsibility for ALL bugs in this modified version.

3. Concept

Let me briefly explain how the program works. Source code is included, so you may examine it on your own and modify it under the restrictions of the GNU General Public License. If you had problems when you first run NOLOCKWS, read on, it may help you to understand the failure. If you did not have any problems yet and if you are not interested in the technical backgrounds, you can safely skip this section and go directly to the Usage section.

The Windows NT Security dialog with the Lock Workstation button is contained as dialog resource #1000 (NT 3.51) or #1650 (NT 4.0) resp. in %systemroot%\system32\msgina.dll. First, NOLOCKWS tries to detect the language of this file with the GetFileVersionInfo() and VerQueryValue(..., "\\VarFileInfo\\Translation", ...) API calls. Currently, Danish, Dutch, English, Finnish, French, German, Italian, Norwegian, Portuguese, Spanish and Swedish are implemented (Portuguese may have a problem with code page conversion). Then, NOLOCKWS scans msgina.dll for the text on the Lock Workstation button, which it knows for these languages. For the English version, this is Lock &Workstation in Unicode (16 bit), the '&' in front of the 'W' denotes the accelerator key Alt-W (the letter which is underlined in the dialog). NOLOCKWS makes sure that this text appears only once in msgina.dll. If so, it is most likely part of a ControlData structure, which appears for each control element in the dialog and is defined in the resource file format documentation found in \doc\filefrmt\resfmt.txt on the Win32 SDK CD as follows:

struct ControlData {
    DWORD  lStyle;             // 0x50010001L for the LW button
    DWORD  lExtendedStyle;     // 0x00000000L for the LW button
    WORD   x;                  // x position in pixel
    WORD   y;                  // y position in pixel
    WORD   cx;                 // width in pixel
    WORD   cy;                 // height in pixel
    WORD   wId;                // control id for the LW button
                               // (1007 for NT 3.51, 1651 for NT 4.0)
    [Name or Ordinal] ClassId; // 2 WORDs: 0xFFFF (Ordinal), 0x8000 (Button)
    [Name or Ordinal] Text;    // English: Lock &Workstation, in Unicode
    WORD   nExtraStuff;        // ???
};

If you are using Novell's IntraNetware Client for Windows NT, you have to modify nwginar.dll in %systemroot%\system32\nls\english, because msgina.dll is no longer used. NOLOCKWS detects Novell through the registry entry HLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL.

4. Usage

Again: This program is still in BETA state and is distributed WITHOUT ANY WARRANTY. Before you use this program, make a backup of all your important data, create an Emergency Repair Disk (with RDISK /S), and have your three NT Setup disks and the CD to hand, since it is possible that an unexpected failure may leave your system in an unusable state (although I have not experienced any problems yet and have received only positive feedback on version 0.9).

Using this program is simple:

• Log on as a user with administrative privileges (not necessarily the Administrator account, but the program explicitly checks if you are a member of the Administrators group). You must have permissions to modify files in the %systemroot%\system32 directory (this is not checked explicitly). Usually Full Control is granted by default at least to the Adminstrators group.
• Close all running applications, to avoid loss of data if something goes wrong. You have to reboot later anyhow.
• Invoke the program from the Command Prompt. Command line switches are not supported. You have to answer three questions (plus one if it is O.K. to reboot). The default answer (when you press Enter) is shown in brackets []. You can interrupt the program at any time with Ctrl-C or Ctrl-Break:
  1. Where is msgina.dll located?
     NOLOCKWS suggests the %systemroot%\system32 directory (%systemroot% is expanded to e.g. c:\winnt). Unless you do not want to modify the original file (see below), you should accept it and press Enter.
     If you are using Novell's IntraNetware Client (NOLOCKWS will detect this case), the file which must be modified is nwginar.dll in %systemroot%\system32\nls\english. You may have to replace english with your language.
  2. Type in exactly the text on your Lock Workstation button (this text depends on your language). You must pay attention to upper/lower case letters. In front of the accelerator key (the letter that is underlined), type an &-character.
     If you have an US/English or other automatically detected version of Windows NT, accept the proposed Lock &Workstation (or its equivalent in your language). Otherwise press Ctrl-Alt-Del to look up the text in your language at the Windows NT Security dialog.
  3. Do you want to (a)llow or (d)isallow workstation locking?
     Answer with 'd' (this is the default) if you run this program for the first time. You can undo the changes later if you choose an 'a' here, but you must have rebooted before!
• NOLOCKWS will now make the desired changes to msgina.dll (or nwginar.dll) and then ask you if you want to reboot Windows NT. This is necessary to activate the changes and must be done before you run NOLOCKWS again.

On successful completion, NOLOCKWS will have created a backup of the unmodified msgina.dll called msgina.bak (nwginar.bak resp.) in the same directory. If this file already exists (when you run the program for the second time), NOLOCKWS will prompt you to rename (switch to File Manager/Explorer, rename it, switch back to NOLOCKWS, then choose retry) or delete it.

An alternative installation method

If you are afraid of directly modifying important Windows NT system files, but have experience using the registry editor RegEdt32, you may want to try a different method of modifying and installing msgina.dll:

• copy %systemroot%\system32\msgina.dll to c:\temp
• run NOLOCKWS as described above, but answer the question Where is msgina.dll located? with c:\temp, do not reboot
• rename the modified file e.g. to msgina_nolock.dll and copy it back to %systemroot%\system32
• with RegEdt32, add a value GinaDll, type REG_SZ, string msgina_nolock.dll under the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key
• reboot now
• you can switch back to the original msgina.dll either by deleting the GinaDll entry or changing its string value to msgina.dll (active at next reboot)

Installation on a larger number of machines

• net use x: \\MachineXYZ\admin$
• copy %systemroot%\system32\msgina.dll to x:\system32
• net use x: /del
• reboot MachineXYZ, e.g. with the Remote Shutdown utility from the NT Resource Kit

Additional remarks

• If you apply a Service Pack, msgina.dll may be replaced with an updated version (which of course again allows locking). In this case, run NOLOCKWS again.
• Virus scanners which store a checksum of all files somewhere may warn you that a virus has infected msgina.dll. Ignore this warning and update the checksum, as long as msgina.dll is the only suspicious file.

Desaster recovery, if something went wrong

I hope this never happens, these are just some untested ideas, because it has not been necessary yet:

• If NT tries to load a currupt or non-existent Gina at boot time, you will either see a Blue Screen Of Death or a reboot at the point where normally the Press Ctrl + Alt + Delete... message appears.
• Boot from the three NT Setup disks and repair the files (especially msgina.dll). If you have any Service Packs installed, many files may appear to be corrupt because the checksums do not match anymore. Then reinstall the Service Pack(s).
• If interactive logins fail, but network access is still possible, it may be possible to map ADMIN$ and replace msgina.dll with the original one from the distribution CD (rename msgina.dll to something else first since it is in use).
• Install a new copy of NT in a different directory on your hard disk if you have enough free disk space. Leave the current file system intact during installation (no formatting). Then replace msgina.dll in the original %systemroot%\system32 directory.

5. Implemented and tested platforms

As a proper GPL program, NOLOCKWS comes with source code. Therefore it should be easy to compile it on any NT platform. Adjust the /machine: qualifiers in the .mak makefile and link with your C runtime library, kernel32.lib, user32.lib, advapi32.lib and version.lib. I have compiled it for Intel x86 with Microsoft Visual C++ 4.2 (Cygnus' gcc for GNU-Win32 lacks <conio.h>), and for DEC Alpha with VC++ 4.1, both under NT 4.0. You should have received both binary versions. They should run under NT 3.5/3.51 as well.

Since NOLOCKWS more or less simply scans msgina.dll for a text sequence and modifies a byte near this sequence where it expects the window attributes for the Lock workstation button (instead of using high level API calls like UpdateResource()), it relies heavily on an unchanged resource format. A quote from the resfmt.txt file states: "Microsoft is NOT committing to stay with these formats by releasing this document." So, the resource file format might change in newer (>4.0) versions of Windows NT (e.g. 64 bit NT 5.0 for axp), and NOLOCKWS will fail. Try it very carefully on these versions! It is possible that NOLOCKWS will be obsolete for newer NT versions if Microsoft reacts on customer requests.

NOLOCKWS runs fine on NT 4.0 Server and Workstation U.S. (x86) and NT 4.0 WS U.S. (axp). I have successfully modified U.S. msgina.dlls from NT 3.51 x86 and axp, which indicated an identical resource format. Further, I have tested it with Danish, Dutch, English, Finnish, French, German, Italian, Norwegian, Portuguese, Spanish and Swedish msgina.dlls from NT 3.51 on a U.S. NT 4.0 system. Portuguese may not work on a pure Portuguese system due to code page conversion problems (if Portuguese uses code page 860).

To do: More tests, especially on international versions (I need the text in your local language. Please help me, see section 7). Or implement language detection with LoadResource.

This program does not run on Windows 95! (Why should it?)

6. Files

7. Feedback/possible improvements

If you have any suggestions, ideas for improvements, problems or anything else concerning the program or the documentation, send an e-mail to Alexander.Frink@Uni-Mainz.DE or snailmail to Alexander Frink, Hermann Schauss Str. 8, D-65232 Taunusstein, Germany.

A short list of possible improvements I have collected:

• command line switches to automate program execution
• test with Portuguese versions of Windows NT
• detect language with LoadResource (but this will definitely fail on NT versions >4.0)