Ctrl+Alt+Del in Remote Desktop: press Ctrl+Alt+End (and what to do on a Mac, a laptop or nested RDP)

Short answer: press Ctrl+Alt+End. In Remote Desktop Connection (mstsc) and in Windows App on Windows, that combination opens the remote computer’s Ctrl+Alt+Del screen, with Lock, Sign out, Change a password and Task Manager. Ctrl+Alt+Del itself always goes to your own computer, because Windows keeps that combination for the local machine. On a Mac, press Fn+Control+Option+Delete.

Why Ctrl+Alt+Del does not reach the remote computer

Ctrl+Alt+Del is Windows’ secure attention sequence. The operating system on the machine in front of you catches it before any program sees it, so a Remote Desktop window never gets the chance to forward it. Microsoft’s Remote Desktop clients therefore map a few system shortcuts to substitutes. Ctrl+Alt+End is the documented stand-in for Ctrl+Alt+Del, and it works in a window as well as in full screen.

The other substitutes are worth knowing while you are at it:

Whether the normal Windows shortcuts such as Alt+Tab reach the server depends on the client’s Apply Windows key combinations setting, under Show Options and then Local Resources. The default sends them to the server only in full-screen mode. Ctrl+Alt+Del is the exception that never passes, whatever you set there.

If all you want is the remote Task Manager, you can skip the security screen. Right-click the remote taskbar and choose Task Manager, or type taskmgr in the remote Start menu. In full screen, Ctrl+Shift+Esc opens it directly as well, because with that default setting the client then passes Windows key combinations to the server.

On a laptop without an End key

Compact keyboards often fold End into another key, reached with Fn. Look at the small second label on the keys. End often shares a key with the right arrow or Page Down, and Apple keyboards use Fn+Right Arrow for it. Hold Ctrl and Alt, then press the Fn combination for End. If that fires the key’s main function instead, your laptop may have Fn Lock on. Toggle it (often Fn+Esc) or check the manufacturer’s documentation, since the layout differs between models.

If you cannot produce End at all, skip the keyboard. The On-Screen Keyboard and the PowerShell command below need no special keys.

On a Mac: Windows App

In Windows App, the client that replaced Microsoft Remote Desktop on macOS, press Fn+Control+Option+Delete. Control and Option stand in for Ctrl and Alt. The Fn is needed because the Mac’s Delete key is a backspace. Apple documents Fn+Delete as forward delete on keyboards without a separate forward-delete key, and forward delete is what Windows expects. On a full-size Apple keyboard with a ⌦ key, Control+Option+⌦ does the same. Newer Macs label Fn with a globe, and the globe key works the same way.

Microsoft lists Fn+Control+Option+Backspace for its browser-based client on macOS, the same keys on a Mac keyboard. That browser client connects to Microsoft’s cloud desktops such as Azure Virtual Desktop and Windows 365, not straight to a server’s IP, so it is not how you reach a VPS. Everything else about the Mac client is in RDP from a Mac.

When no shortcut works: the On-Screen Keyboard

The On-Screen Keyboard runs inside the remote session, so the clicks it produces never pass through your own computer’s key handling. Mix it with your physical modifier keys:

1. 1Open the On-Screen Keyboard in the remote session

   Open the remote Start menu (click it, or press Alt+Home in a window), type osk and press Enter.

2. 2Hold Ctrl and Alt on your real keyboard

   The Ctrl and Alt keys on the on-screen keyboard light up while you hold them.

3. 3Click Del on the On-Screen Keyboard

   The Windows Security screen of the remote computer opens. Close the On-Screen Keyboard afterwards.

Open the security screen with one command

Windows has a shell method that opens the same screen Ctrl+Alt+Del shows. Microsoft documents it as working only in a Remote Desktop session, which is exactly where you need it. Run it in PowerShell inside the session:

(New-Object -ComObject Shell.Application).WindowsSecurity()

If you need it often, put it in a desktop shortcut on the server. Use this as the shortcut’s target, and a double-click opens Windows Security:

powershell.exe -NoProfile -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).WindowsSecurity()"

RDP inside RDP: reaching the inner session

If you connect to server A and from there to server B, Ctrl+Alt+End is caught by the outer client and opens the security screen of server A, not B. Microsoft’s documentation says outright that its keyboard shortcuts do not work in nested sessions. Two ways reach the inner server:

• PowerShell on server B: run the WindowsSecurity() command from the previous section inside the inner session. No keys are involved, so the nesting does not matter. This is the most reliable route.
• On-Screen Keyboard on server B: start osk inside the inner session, hold Ctrl and Alt on your physical keyboard and click Del on it, as in the steps above. The held modifier keys travel through both connections, and Del comes from inside server B itself.

In the provider’s VNC console

A browser console in a hosting panel is not RDP. It is a VNC view of the server’s screen, so Ctrl+Alt+End does nothing there, and a real Ctrl+Alt+Del again stays on your own computer. You need it most at Windows’ console login screen, which asks for Ctrl+Alt+Del before it shows the password box. The difference between the two protocols is explained in RDP vs VNC.

In the VMHeaven panel, the console has a Send Ctrl+Alt+Del button. The panel asks you to confirm before sending, because the combination goes to the server: on Windows it opens the security screen, but on Linux it can reboot the machine, depending on its configuration. The console’s paste field types long passwords into the login box for you, key by key.

Ctrl+Alt+End still does nothing? Check these in order

• Focus is on your own desktop. Click once inside the remote window, then press the keys again. The shortcut goes to whichever window is active.
• You are in a browser console, not in RDP. Ctrl+Alt+End means nothing to a VNC console. Use its Ctrl+Alt+Del button.
• The session is nested. The outer client takes the shortcut. Use the On-Screen Keyboard or the PowerShell command inside the inner session.
• Another program on your computer owns the combination. Hotkey tools, keyboard utilities and some vendor control panels register global shortcuts. Quit them and try again.
• The client is not Microsoft’s. Remmina, FreeRDP-based apps and other third-party clients have their own menu entry or mapping for it. Look in the client’s toolbar or documentation.

Change your password over RDP with Ctrl+Alt+End

Changing your own password is the most common reason to need Ctrl+Alt+Del in a remote session.

1. 1Press Ctrl+Alt+End and choose Change a password

   Use one of the alternatives above if the shortcut does not work on your keyboard.

2. 2Enter the old password, then the new one twice

   Press Enter. Windows confirms the change, and the session carries on.

3. 3Update the saved password in your RDP client

   Remote Desktop Connection and Windows App keep saved credentials. Edit or delete the stored entry, or the next connection fails with the old password. Repeated failures can also trip an account lockout policy.

As an administrator you can also reset a local account’s password without knowing the old one. That is meant for other users or for recovery. Replace USERNAME with the account’s name; both ways ask for the new password without showing it:

$pw = Read-Host -AsSecureString "New password"
Set-LocalUser -Name "USERNAME" -Password $pw

net user USERNAME *

When the password has already expired

An expired password is a different problem. With Network Level Authentication on, the RDP client checks your password before a session exists, so it reports that the password has expired instead of offering to change it. Do not switch NLA off to get around this. Log in through the provider’s console instead. A console login is a local logon, and Windows offers the password change right there on the login screen.

Then check whether the account’s password expires at all. On a stand-alone Windows Server, the default maximum password age is 42 days. Microsoft’s current security baseline no longer includes password expiry, so on a single-admin server with a long, unique password and a locked-down RDP port, you can turn it off for that account. First look at the current expiry date:

net user Administrator | findstr /C:"Password expires"

A date there means the password will expire; Never means it already does not. To switch expiry off for the account:

Set-LocalUser -Name "Administrator" -PasswordNeverExpires $true

Sign out, do not just close the window

The same Ctrl+Alt+End screen has the Sign out button, and it matters on a server. Closing the RDP window only disconnects you. Your programs keep running, and on Windows Server the session keeps one of the two administrative slots busy, as described in multiple RDP sessions on Windows Server. Disconnect when you want to come back to running work. Sign out when you are done.

Every Windows VPS at VMHeaven gives you the Administrator account over RDP, plus the browser VNC console with its Ctrl+Alt+Del button for the moments RDP will not let you in. You can pay by card, PayPal or crypto (Bitcoin, Ethereum, USDT, Litecoin, Monero and more), and the Windows RDP page explains the crypto route without an ID check.

Frequently asked