Vitrine – Transparent screen lock for Windows

Why a transparent lock screen? Lock the PC, keep the screen visible

The normal Windows lock (Win+L) shows the lock screen, and nothing of the workstation stays visible. In a laboratory, on a production line or in a control room, you need to lock the PC but keep the screen visible: a measurement is running, a plant display or a dashboard is being monitored.

Vitrine therefore locks only the input. Keyboard and mouse are intercepted system-wide, the programs stay visible and keep running – look, don’t touch. You decide who may unlock: the signed-in person, administrators, groups and Entra app roles, single accounts or any valid account, restrictable to domains.

Features: lock keyboard and mouse, screen stays visible

• Transparent or covered

  Transparent with a light dimming (8 %) by default. For confidential content, the covered mode shows a large clock and the date – programs still keep running.

• Cover areas, reveal programs

  Rectangles stay covered while locked, e.g. the part of a LIMS window with patient names. Or everything is covered except the windows of selected programs.

• Unlock with Entra ID, Windows or a security key

  Microsoft Entra ID runs in Vitrine’s own sign-in window, which remembers nothing between people – with everything the tenant allows: passkeys and FIDO2 keys, Authenticator, MFA. Plus the Windows password, the Windows sign-in dialog (smartcards too), Windows Hello and a FIDO2 security key registered for Vitrine.

• Your own security keys without Entra ID

  An authorised person registers FIDO2 keys for Vitrine – locally on the computer or once for all computers in Active Directory, without an app registration in Entra ID and also without a network. The service checks every sign-in and resolves the person and their groups; the key’s PIN is always required.

• Lock in many ways

  Ctrl+Alt+L, notification area, idle time, schedule, at startup, as a screen saver, Vitrine.exe --lock or the local interface; optionally Win+L locks with Vitrine instead of Windows.

• Electronic signatures

  Line-of-business applications such as a LIMS request a signature over a local interface. Person, time, reason and meaning go into the audit log. For the Windows password, Entra ID and registered security keys, the service checks the sign-in itself.

• Audit log signed by the service

  Every lock, unlock, failed attempt and signature with UTC time, person and method. The service writes the log and signs every entry (ECDSA P-256 with a machine key only it holds); users can only read. Sequence numbers and an anchor outside the file make changes, gaps and a cut-off end visible, and Vitrine.exe --verify-log verifies with the public key. A copy on a network share and the Windows event log add independent records.

• Roles and accountability

  Separate roles for configuration administrators, security key registrars and auditors (read and export only), optionally with no rights for local administrators. Emergency sign-in for defined groups only with a reason, configuration changes recorded with old and new values and an optional mandatory reason, the responsible person in the log, and an authorization report as HTML to sign and as CSV.

• Managed centrally

  ADMX/ADML templates (English and German) with 76 policies for Group Policy and Intune; values set by policy are locked in the settings. Silent install with msiexec /i Vitrine-x64.msi /qn.

• Lock on a separate desktop

  Optionally Vitrine switches to a desktop of its own while locked: windows of other programs – elevated ones too – get no input there and cannot draw over the lock screen. In both lock modes Vitrine detects desktop switches while locked, logs them and switches back.

• Service and watchdog

  The service “ICT-Baden Vitrine” starts Vitrine at every sign-in. If Vitrine ends or hangs while locked, it disconnects the session and starts Vitrine locked again; without the service, a watchdog locks Windows.

• Limit failed attempts

  Growing waiting time from the third attempt; optionally lock Windows, sign out or shut down after too many attempts – this action is off by default and has to be configured.

• Five languages

  English, German, Spanish, French and Chinese (simplified); each user picks their own, or a policy sets it.

Where it is used: labs, production, control rooms

Typical workstations are measurement PCs in laboratories, operator PCs on production lines and control-room PCs whose displays must stay visible. Vitrine places one overlay per monitor, matched to each monitor’s scaling, and optionally shows a notice such as “Measurement running – please do not touch”. While locked, the screen stays on: no screen saver, no sleep.

For control rooms and measurement PCs, Vitrine can lock at startup. The keyboard and mouse lock also covers the Windows key, Alt+Tab, Alt+Esc, Alt+F4 and Ctrl+Esc, the mouse pointer is held, and Win+L does nothing while locked. On shared workstations anyone in a local or Entra group unlocks with their own key or account; whoever unlocked last is shown as the responsible person in the notification area and recorded in the log.

Pharma and GxP: 21 CFR Part 11 and EU GMP Annex 11

Vitrine provides building blocks that GxP workstations ask for: access limited to authorised people, unique identification, an audit trail signed by the service, electronic signatures with a meaning – for the Windows password, Entra ID and registered security keys the service checks the sign-in itself –, separate roles with an authorization report for periodic review, an emergency sign-in with a reason, and automatic locking after idle time or on a schedule. The shared unlock password is refused for signatures because it is not attributable to a person.

Vitrine is not a validated product, and ICT Baden makes no claim that using it meets 21 CFR Part 11, EU GMP Annex 11 or any other regulation. Validation and the risk assessment are the operator’s responsibility; code and log format are kept simple so that a validation is feasible. Without the service – that is, with the single Vitrine.exe – there is only a hash chain without a key, which the documentation explicitly rates as not Part 11 capable.

Switching from commercial transparent screen locks: Vitrine as an alternative

For organisations that use a commercial transparent screen lock today – as a stand-alone program or as a feature of an authentication suite: they all do the same job, input is blocked while the screen stays visible. Vitrine is an alternative to these transparent locks with the following properties:

• Vitrine is free of charge under the MIT licence, with no licence key, no licence server, no activation and no device binding; it sends no data to ICT Baden.
• Delivered as an MSI (silent with msiexec /i Vitrine-x64.msi /qn), managed through 76 policies in ADMX/ADML templates for Group Policy and Intune.
• Unlock with Microsoft Entra ID, the Windows password, Windows Hello or a FIDO2 security key registered for Vitrine – the latter without an Entra app and also without a network; electronic signatures for line-of-business applications.
• Tamper-evident audit log signed by the service, roles for settings, key registration and review, covered areas and “only selected programs visible”.

What switchers should know: Vitrine is a pre-release, not code-signed yet and not yet tested end to end on real devices. It has no smartcard or card-reader integration of its own – fingerprint and face work through Windows Hello, smartcards through the Windows sign-in dialog, anything else through your own sign-in plugin. Vitrine replaces only the transparent lock, not an authentication suite.

System requirements

Operating system

Windows 10 version 1809 (build 17763) or later, or Windows 11, 64-bit

.NET

not needed for the MSI and Vitrine.exe; the ZIP variant needs the .NET 10 Desktop Runtime

Installation

the MSI needs administrator rights; Vitrine.exe runs without installation

Microsoft Entra ID

optional, for unlocking, signatures and administrator confirmations: an app registration in your tenant (redirect URI http://localhost, optional claim auth_time); the sign-in window needs the Microsoft Edge WebView2 Runtime; sign-in needs the network

Security keys

optional: Windows 10 version 1903 or later, the Vitrine service (MSI installation) and FIDO2 keys with a PIN (USB or NFC); stored locally or in Active Directory

Files

Vitrine-x64.msi, Vitrine.exe, Vitrine-win-x64-framework.zip, SHA256SUMS.txt, bill of materials Vitrine-sbom.cdx.json

Limits, honestly

• Pre-release, not code-signed yet: Windows SmartScreen warns. Not yet tested end to end on real devices – Entra ID with MFA, Windows Hello, Remote Desktop, multiple monitors and the MSI on a clean machine are still open; security keys, the Active Directory store and the lock on a separate desktop have so far been checked by automated tests only.
• Vitrine’s own Microsoft sign-in window does not meet Conditional Access conditions that need the device identity (“compliant device”, “hybrid joined”) – exclude the Vitrine app from such policies or enable the Windows account broker on devices with a personal user.
• Ctrl+Alt+Del cannot be intercepted by any application. Vitrine hides Task Manager, Sign out, Change a password, the power button and Lock there and switches Win+L off while locked; Switch user remains.
• Vitrine runs as a normal user process supervised by a service; administrators can stop both.
• Transparent means visible – choose the covered mode or covered areas for confidential content.
• The audit log is tamper-evident, not tamper-proof: it makes changes visible but cannot prevent them. Administrators can stop the service and take over its key; the network copy and the forwarded event log are the second trail.
• Sign-ins with Entra ID need the network; keep the Windows password, Windows Hello or registered security keys enabled for offline cases.
• After failed attempts there is only a growing waiting time by default; an action after too many attempts has to be configured.
• Spanish, French and Chinese are machine translations and not yet reviewed by native speakers.