Hisham -
You can't. That particular keystroke sequence is built into the PC hardware (generates a NMI interrupt) and can only be caught when the CPU is running in privledged mode. And if you're running Windows NT, the only way your code will be able to do that is via a keyboard driver. And I doubt even then, as NT calls it the "Secure Attention Sequence", and the NT kernel may catch it even before the keyboard driver.
You might have a chance of catching this keystroke group if you're running Windows 9x, but a keyboard driver would still be required.
If you're looking to hook into the NT logon sequence, look at the Visual C sample called "Gina". A Gina DLL is a "C" DLL which is called to verify logon credentials. You still can't trap the SAS, but you might be able to perform other actions based on receiving a logon, logoff request.
Chip H.