C# Windows Security Center Settings

Question

I would like to disable the Action Center messages in Windows. I know where the registry holds the values for these checks but those are machine specific. And I know that I can disable the complete service. But I do not want to disable the service, I only want to not show the notifications/alerts/messages.

To see these options I am talking about goto: cmd.exe -> RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

The security center will be started and click on the left on "Change Action Center settings".

Now I have referenced "C:\Windows\System32\wscui.cpl" in my C# project and added

using SecurityCenterAdmin;

I see I can create this object

SecurityCenterAdmin.WscAdmin admin = new WscAdmin();
admin.DoModalSecurityAction();

But I can find no references about it. Searching on Google for "WscAdmin msdn" or "SecurityCenterAdmin" yields no results.

Any hints?

Thanks in advance. Mike

Answer 1

If you're unwilling to go through the proper channels to get access to the API (wscisv@microsoft.com). You can always try robot-ting the process.

• Use Process.Start to open the action center, you seem to already have the command line "RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl".
• Use the FindWindow and FindWindowEx API functions to get window and control handles. http://msdn.microsoft.com/en-us/library/windows/desktop/ms633499%28v=vs.85%29.aspx You'll want to make use of the "Microsoft SPY++" Windows SDK tool for getting class names etc.
• Use the SendMessage API to simulate mouse messages to the window/controls http://msdn.microsoft.com/en-us/library/windows/desktop/ms644950%28v=vs.85%29.aspx WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE etc etc. Using SPY++ will also help with this process.

If you're doing this without properly notifying the user then your software is pretty shady - maleware. I could see practical uses, as an internal program your company may use to quickly configure stand alone desktops or something, but it's really a stretch.

Answer 2

The behavior you describe is consistent with actions malware might take, therefore the system should be actively prohibiting this.

It seems that a private API exists for interacting with the Windows Security Center. As mentioned here, this interface is subject to NDA and could be obtained by contacting Microsoft (see details in the answer to the mentioned post) if your application has legitimate requirements for it.

There is also a public API for querying the WSC: documentation, sample.