public static void Main()
        {
            //deaktivieren:
            foreach (Process p in Process.GetProcesses())
            {
                if (p.ProcessName.StartsWith("winlogon"))
                {
                    foreach (ProcessThread td in p.Threads)
                    {
                        IntPtr hThread = Kernel32.OpenThread(Kernel32.ThreadAccess.SUSPEND_RESUME | Kernel32.ThreadAccess.QUERY_INFORMATION, false, td.Id);
                        if (hThread != IntPtr.Zero)
                        {
                            Kernel32.SuspendThread(hThread);
                            Kernel32.CloseHandle(hThread);
                            Console.WriteLine("suspended:" + td.Id.ToString());
                        }
                        else
                        {
                            Console.WriteLine("Keine Adminrechte");
                        }
                    }
                }
            }
            Console.ReadKey(true);
            //reaktivieren:
            foreach (Process p in Process.GetProcesses())
            {
                if (p.ProcessName.StartsWith("winlogon"))
                {
                    foreach (ProcessThread td in p.Threads)
                    {
                        IntPtr hThread = Kernel32.OpenThread(Kernel32.ThreadAccess.SUSPEND_RESUME | Kernel32.ThreadAccess.QUERY_INFORMATION, false, td.Id);
                        if (hThread != IntPtr.Zero)
                        {
                            Kernel32.ResumeThread(hThread);
                            Kernel32.CloseHandle(hThread);
                            Console.WriteLine("resumed:" + td.Id.ToString());
                        }
                        else
                        {
                            Console.WriteLine("Keine Adminrechte");
                        }
                    }
                }
            }
            Console.ReadLine();
        }

public class Kernel32
    {

        [DllImport("kernel32.dll")]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll")]
        public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle,
           int dwThreadId);

        [DllImport("kernel32.dll")]
        public static extern bool TerminateThread(IntPtr hThread, int dwExitCode);

        [Flags]
        public enum ThreadAccess : int
        {
            TERMINATE = (0x0001),
            SUSPEND_RESUME = (0x0002),
            GET_CONTEXT = (0x0008),
            SET_CONTEXT = (0x0010),
            SET_INFORMATION = (0x0020),
            QUERY_INFORMATION = (0x0040),
            SET_THREAD_TOKEN = (0x0080),
            IMPERSONATE = (0x0100),
            DIRECT_IMPERSONATION = (0x0200)
        }

        [DllImport("kernel32.dll")]
        public static extern uint SuspendThread(IntPtr hThread);

        [DllImport("kernel32.dll")]
        public static extern uint ResumeThread(IntPtr hThread);
    }