Ctrl+Alt+Del now works, and every remote action reports what actually happened.
Ctrl+Alt+Del is a Secure Attention Sequence, so injected keystrokes can never produce it. The agent already called SendSAS, but the SoftwareSASGeneration policy that makes SendSAS do anything was never set — and SendSAS returns void, doing nothing when refused. The log read "Ctrl+Alt+Del sent." while the machine sat there.
Installing Admin Mode now sets that policy, and the handler checks both prerequisites before calling so it names whichever is missing instead of claiming success.
The same pattern ran through the other actions. Lock discarded the boolean LockWorkStation returns, so a refusal logged as a success. Restart, shutdown and sign-out logged the command line on launch, but starting shutdown.exe says nothing about acceptance — it exits 5 on access denied and 1115 when a shutdown is already pending. All of them now check and report the real reason.
Note: the Ctrl+Alt+Del fix takes effect when Admin Mode is installed, since that is the elevated moment where the policy is written. On a machine that already has Admin Mode, turn it off and on again.