How to Disable the Windows 10 ‘Ease of Access’ Button on the Login Screen

The Login Screen Vulnerability

On the Windows 10 login screen (before you type your password), there are a few buttons in the bottom right corner. One of these is the “Ease of Access” button (shaped like a dial or a dotted circle), which allows users to quickly launch accessibility tools like the Narrator, Magnifier, or On-Screen Keyboard without needing to log in.

While helpful for users who require these tools, this button has historically been exploited by attackers with physical access to the machine. By replacing the underlying executable file for the Ease of Access tools (utilman.exe) with the Command Prompt executable (cmd.exe) using a bootable USB drive, an attacker could click this button on the login screen and gain a system-level command prompt without needing a password. If you do not use these accessibility tools and want to harden your physical security, you can disable the button via the Windows Registry.

How to Disable the Ease of Access Button

You must use the Registry Editor to remap the executable to a dummy value.

1. Click the Start button, type regedit, and press Enter to open the Registry Editor. (Click “Yes” if prompted by User Account Control).
2. Navigate to the following path using the folders in the left sidebar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

3. Right-click on the Image File Execution Options folder, select New, and click Key.
4. Name this new key exactly: utilman.exe
5. Select the new utilman.exe key you just created.
6. In the right-hand pane, right-click on an empty space, select New, and click String Value.
7. Name this new string exactly: Debugger
8. Double-click the Debugger string you just created.
9. In the “Value data” box, type the following exactly:

"Dummy Program"

10. Click OK and close the Registry Editor.

The change is immediate. If you lock your PC (Windows Key + L) and click the Ease of Access button on the login screen, absolutely nothing will happen. The system attempts to launch the non-existent “Dummy Program” instead of the accessibility tools.