How can I prevent the user from using Snip and Sketch to take screen shots?

Raymond Chen

A customer wanted to know how they could disable the Snip and Sketch feature of Windows 10. They tried deploying policy to block the execution of C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe, but that didn’t help.

Okay, first of all, ScreenSketch.exe is not Snip and Sketch. Screen Sketch is a feature of the Windows Ink Workspace that lets you draw directly on the screen. It’s not the Snip and Sketch tool. Snip and Sketch (as of this writing) is part of the ShellExperienceHost.exe process, and if you block that process, you lose all sorts of things like the taskbar Calendar, the wireless network chooser, and a number of other shell features.

(Note that the above information is not contractual. The implementation details of various shell features may, and indeed have, changed over time.)

We asked why the customer felt the need to disable the Snip and Sketch feature.

The customer liaison explained that they had a program that displayed proprietary information and didn’t want their employees making screen copies of the data.

Disabling the Snip and Sketch feature is not going to solve your problems. There’s also the Snipping Tool, the PrtSc key, and all number of third party screen capture utilities. And even if you manage to get them all, the employee could just take out a digital camera and snap a photo.

That said, the customer could modify their proprietary program to call the SetWindowDisplayAffinity function to indicate that the window contents should not be included in screen captures, as I noted some time ago. The desktop compositor will prevent those pixels from being included in BitBlt and other screen capture functions.

UWP applications can set the ApplicationView.IsScreenCaptureEnabled property to false to exclude a view from screen capture functions.

Topics

Author

Raymond Chen

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

14 comments

Discussion is closed. Login to edit/delete existing comments.

Dan Bugglin May 6, 2020

There's probably still a way to capture. Possibly video capture/streaming software that works at a low enough level would still be able to capture it.

I hope you let the customer know that about the amazing modern convenience called the pen (or pencil) that a malicious actor could use to WRITE DOWN information displayed on the screen. What they're trying to do is ultimately futile. There's always going to be an "analog hole" at the very least.

https://en.wikipedia.org/wiki/Analog_hole

Edit: Also this reminds me of airport body scanners. There was some controversy about images they captured being potentially pornographic with how they could see...
Read more
There’s probably still a way to capture. Possibly video capture/streaming software that works at a low enough level would still be able to capture it.

I hope you let the customer know that about the amazing modern convenience called the pen (or pencil) that a malicious actor could use to WRITE DOWN information displayed on the screen. What they’re trying to do is ultimately futile. There’s always going to be an “analog hole” at the very least.

https://en.wikipedia.org/wiki/Analog_hole

Edit: Also this reminds me of airport body scanners. There was some controversy about images they captured being potentially pornographic with how they could see through clothes to some degree. There were assurances made the computers that displayed the images to TSA agents could not be used to permanently save images. Guess what happened?

Read less
Filip Skakun May 6, 2020

Some of the introductory information isn't entirely accurate, but it indeed matches with users' perception of the experience and the proposed problem solution would work in some scenarios (where you control the code of apps that present the data you don't want captured).

ScreenSketch.exe is indeed the process and main executable of the Snip & Sketch (proper) app. To most users Snip & Sketch is both this app and the actual "modern snipping experience" as I like to call it, but as you suggest - ShellExperienceHost.exe hosts the actual snipping UI that runs separately from the ScreenSketch.exe process and its main...
Read more
Some of the introductory information isn’t entirely accurate, but it indeed matches with users’ perception of the experience and the proposed problem solution would work in some scenarios (where you control the code of apps that present the data you don’t want captured).

ScreenSketch.exe is indeed the process and main executable of the Snip & Sketch (proper) app. To most users Snip & Sketch is both this app and the actual “modern snipping experience” as I like to call it, but as you suggest – ShellExperienceHost.exe hosts the actual snipping UI that runs separately from the ScreenSketch.exe process and its main logic lives in ScreenClipping.dll.

If you’re an admin and want to prevent using specifically modern snipping (which again – many users see as the main part of Snip & Sketch) from capturing any app – you can use AppLocker to block ScreenClipping.dll.

Now, you may still want to try to block PrtScn, the classic Snipping Tool, snipping from OneNote, PowerPoint, Word, Excel, screen capture from Teams, Skype, the browser etc. (if even possible) and installing other apps that could capture your screen and see the complete block isn’t possible, but you can still do some work to make it more difficult to take and potentially share screenshots. Raymond’s solution is the only one that should address all of these and will only fail a physical camera or smartphone test.

One additional problem is – I think Raymond’s solution might also prevent seeing the blocked windows from remoting over Remote Desktop and similar solutions which might be good or bad depending on your security environment.

Read less
- GL May 7, 2020
  
  Setting window affinity doesn’t exclude it from remote desktop, and I don’t think it prevents the window from being taken screenshots of in a remote desktop session. At least that was the case for some early version of Windows 10. I remember accidentally discovering that I could screenshot DRM-protected content in Videos (now known as Movies & TV) in a remote session.
Piotr Siódmak May 6, 2020

tsk, tsk, it’s not like you (Microsoft) never tried to do the same thing: https://support.microsoft.com/en-us/help/2006298/print-screen-functionality-fails-with-no-error-message

🙂

I recall there also being a support article explaining how no software nor hardware will prevent the user from taking a photo with their phone or just writing it down on a piece of paper, but I can’t find it now. It was helpful with a few customers.
- Entegy May 6, 2020
  
  Where’s that old article about throwing stones in glass houses? Raymond is not Microsoft, and Outlook is not his product. He knows that when he writes about things that are done incorrectly, there’s likely a Microsoft product that also does the thing incorrectly.
  - cheong00 May 6, 2020
    
    Btw, I would have thought about “how to enable a window with HDCP protection”
Erik Fjeldstrom May 6, 2020

This sounds like another walls and ladders issue, but if this is just to prevent accidental disclosure of information it should be fine. Otherwise, if you can’t trust your employees not to divulge confidential data I think that you’ve already lost and should think about why you’re having the problem in the first place.