Group Policy Changes Keep Reverting: CTRL+ALT+DEL Lockscreen Issue After Installing Antivirus

The CTRL+ALT+DEL requirement at the Windows login screen is controlled by a specific Group Policy setting, not directly by antivirus software. When an antivirus installation appears to force this change, it often modifies the local security policy or registry keys associated with interactive logon behaviors. If uninstalling the software does not revert the behavior, the policy change has likely been persisted in the system configuration or applied via domain policies that remain active. This article explains how to verify and correct the "Do not require CTRL+ALT+DEL" setting using standard administrative tools.

Understanding the Control Panel Applet Setting

The most common cause for this issue is the configuration of the interactive logon requirements within the Local Security Policy. The setting responsible for requiring CTRL+ALT+DEL is located under Security Settings > Local Policies > Security Options. Specifically, you need to examine the policy named Interactive logon: Do not require CTRL+ALT+DEL. When this policy is set to Enabled, Windows will skip the secure attention sequence (the CTRL+ALT+DEL screen) and go directly to the password prompt. Conversely, if it is set to Disabled or Not Configured, the system will enforce the CTRL+ALT+DEL requirement. Many security suites, including antivirus programs, may apply strict security baselines during installation that inadvertently enable this policy to ensure users cannot bypass authentication screens. Even after removal, if the local group policy cache is not refreshed or if the registry key was modified directly, the setting persists. To check this, press Win + R, type secpol.msc, and hit Enter. Navigate through the tree on the left to find the aforementioned policy. Right-click it and select Edit Properties. Ensure that the option is set to Disabled if you want to remove the requirement, or Enabled if you wish to keep it. In many cases, users mistakenly believe the antivirus caused the *requirement* when they actually want the *absence* of the requirement, or vice versa. Verify the current state matches your desired outcome.

Applying Changes Locally

After modifying the setting, you must force the system to reload the policy configuration. Open a Command Prompt as Administrator and run the following command:

gpupdate /force

This command forces the computer and user policies to update immediately. You should see a message confirming that the policy update was successful. Log off and log back in to test if the behavior has changed. If the issue persists, it may indicate that the change was overridden by a domain-level Group Policy Object (GPO) if the machine is part of a corporate domain.

Registry Verification and Correction

Group Policy settings are ultimately stored in the Windows Registry. If the secpol.msc interface shows the correct setting but the behavior remains unchanged, there may be a discrepancy between the policy editor view and the actual registry values. The relevant registry key is located at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Within this key, look for a DWORD value named DisableCAD. The name stands for "Disable Ctrl-Alt-Del".

• If DisableCAD is set to 1, CAD is disabled, meaning the CTRL+ALT+DEL screen is skipped.
• If DisableCAD is set to 0 or does not exist, CAD is required, meaning the lockscreen appears.

If your antivirus software previously enabled the requirement, it might have set this value to 0. If you are trying to *remove* the requirement, you would set it to 1. However, note that domain GPOs can override these registry values. Always check the effective policy before manually editing the registry. To check the effective policy, you can use the rsop.msc tool (Resultant Set of Policy) to see which GPO is currently enforcing the setting. For more details on managing local security policies, refer to our guide on Preventing Regular Users from Pinning/Unpinning Shortcuts to the Taskbar in Windows 11, which covers similar administrative control concepts.

Domain Group Policy Considerations

In enterprise environments, local changes are often overwritten by domain controllers. If you are on a work or school computer, the secpol.msc editor might appear grayed out or show "No access" because the policy is managed centrally. In such cases, changing the local setting will have no effect until the domain GPO is updated. You can identify if a GPO is applying by running gpresult /r in an administrator command prompt. Look for the "Group Policy Objects Applied" section. If a GPO related to security or logon policies is listed, the settings within it are overriding your local configuration. You will need to contact your IT administrator to modify the GPO in Active Directory Users and Computers or Group Policy Management Console. Modifying domain policies requires appropriate permissions and understanding of the organizational unit (OU) structure. For troubleshooting why a GPO might not apply as expected, see Why does a GPO not apply to a certain OU?.

Clearing Cached Policy Data

Sometimes, the Group Policy client cache becomes corrupted or stale, causing old settings to persist even after changes. The cache is stored in C:\Windows\System32\GroupPolicyUsers and C:\Windows\System32\GroupPolicy. Deleting the contents of these folders (excluding the subfolders for other users or computers) forces Windows to re-fetch the latest policies from the source. Before deleting, ensure you have stopped the Group Policy Client service. Run services.msc, locate the service, stop it, delete the folder contents, and then restart the service. Finally, run gpupdate /force again. This step is particularly useful if the antivirus installation process created temporary policy files that were not cleaned up properly.

Checking for Residual Antivirus Components

If the above steps fail, residual components of the antivirus software may still be active. Some advanced endpoint protection solutions install kernel-level drivers or filter drivers that enforce security policies independently of standard Windows Group Policy. Check the list of installed programs for any remaining entries related to the antivirus vendor. Use the official removal tool provided by the vendor, if available, rather than relying solely on the Windows Add/Remove Programs utility. These specialized tools often clean up registry keys and services that standard uninstallers miss. Additionally, check the Task Scheduler for any tasks created by the antivirus that might re-apply policies upon system startup. Look for tasks that execute scripts or commands related to gpupdate or secedit. If found, disable or delete these tasks after ensuring they are no longer needed for security compliance.

Frequently Asked Questions

Does disabling this policy reduce security?

Yes, disabling the CTRL+ALT+DEL requirement allows malicious software to potentially spoof the login screen and capture credentials. It is generally recommended to keep this requirement enabled, especially on shared or public computers.

How do I know if a domain GPO is overriding my local setting?

Run gpresult /r in Command Prompt. If the output shows a "Denied GPOs" section or lists a domain GPO with higher precedence than your local setting, the domain policy is in control.

Can I restore the default Windows behavior without a domain admin?

If you are not part of a domain, you can manually edit the registry key DisableCAD or use secpol.msc. If you are on a domain, you must request changes from your IT department.

What is the exact registry path for this setting?

The setting is located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System under the DWORD value DisableCAD.

Why did reinstalling Windows fix the issue temporarily?

A fresh Windows installation resets all local Group Policy settings to their defaults. However, if the machine is joined to a domain, the domain GPO will re-apply the restrictive settings shortly after joining.