title: Blocking mouse input from a service in Vista
body: <p>I maintain a variety of managed userlabs on a university campus.  These machines all currently run Windows XP and we have a windows service that is used to "lock" a machine by blocking any keyboard or mouse input.  The locking happens during our scripted OS installation so that users aren't able to accidentally halt or break the process.  It is also used to prevent users from logging into machines until they are checked out at the front desk of a given lab.  Ctrl+Alt+Del is blocked via a keyboard filter driver and the rest of the keys and mouse are currently blocked using the <a href="http://msdn.microsoft.com/en-us/library/ms646290.aspx" rel="nofollow noreferrer">BlockInput()</a> function from user32.dll.</p>
  
  <p>In XP, the service runs as Local System and the checkbox for "Allow service to interact with desktop" must be enabled from the BlockInput() call to succeed.  Under Vista, this no longer works I'm guessing because of the <a href="http://msdn.microsoft.com/en-us/library/bb203962.aspx" rel="nofollow noreferrer">Session 0 isolation</a> changes.  The call succeeds, but input is not actually blocked.</p>
  
  <p>The keyboard filter driver still works just fine and we can use that to block the whole keyboard instead of just Ctrl+Alt+Del.  But I'm at a loss as to how we're going to block the mouse now.  I'm not even entirely sure the Session 0 isolation is to blame.</p>
  
  <p>Can anyone recommend a fix or a workaround to allow us to block mouse input from a service in Vista and beyond?  I've looked for alternative win32 API's without luck.  Assuming Session 0 isolation is to blame, is there a legitimate way to call the function from Session 1 or would that sort of defeat the purpose of the isolation?  Will I have to rely on an elevated companion exe that runs on user login and communicates with the service?</p>