A method of giving a user high-level access privileges if a combination of keystrokes is sent to a desktop is disclosed. Each terminal services session is enumerated and sessions identified. Unidentified sessions have a user-definable process associated with the session. Desktops registered in the terminal services session are identified, and if a new desktop is identified, a thread is created to attach to that desktop and hook the desktop's low-level keyboard input. The keyboard input is then monitored for a pre-defined combination of keystrokes, and if found, a command shell starts, giving the user higher-level access privileges.