I'm trying to see how these commercial password managers seem to show their dialog window on what they claim to be a "Secure desktop". Here's one:
Then if you click its "Unlock on Secure Desktop" button it will show the password window on what appears to be another desktop:
And that desktop doesn't behave like a plain overlay. (I can run Task Manager over it but not much else.)
If I suspend the processes for this login dialog and then check them out from another Windows user account, the process that shows that password dialog doesn't seem to have any special privileges (marked with an arrow):
The logged in user at the time was
DC is the second user that I'm using now to run Process Hacker with. I failed to make other instance of the Process Hacker (running under
Admin) to show on that dark purple desktop with the password dialog.
And here is the token for the password dialog process:
So any idea how they're doing it?