Win32 API hooks and OS hardening

[rashkar]

Hi guys,

I have an application written as a windows service (installed to run as localsystem) that will specifically monitor one application and securely inject a password when it detects the correct screen. It works perfectly when I test it on every PC and VM in the office, but at the client site, the service can't see any windows events AT ALL. I'm really confused.

When i enable full logging of the Win32 events, my app in the office grabs a shedload of events. But the service running on the client site doesn't see a thing. If I launch the observer module at the command line rather than through the service, it works!!

Is there any OS hardening setting that could be blocking my app on the client's PC?

Regards,
mike