Strange Password Protect after resume from screensaver issue

[_techie_]

Hi

We are rolling out SIMS.Net in September, and a member of our leadership group has requested that the machine is locked out after resuming from the screensaver. This is to secure the machine should a member of staff move leave the machine open (with SIMS open), and walk away from it. We initially set this up to work on a User OU in AD as a new policy. Unfortunately, the lockout does not work, but the change we made in the timing of the screensaver is applying from the policy?

Had a quick google, and even tried a reg hack from Microsoft, but this didnt work either...
Has anyone else had this problem. We are running XP SP3 btw...

We have also checked other policies above this one, there are not any which concern this setting in the GPO though.

Thanks
Mark

[ArchersIT]

Hi

We are rolling out SIMS.Net in September, and a member of our leadership group has requested that the machine is locked out after resuming from the screensaver. This is to secure the machine should a member of staff move leave the machine open (with SIMS open), and walk away from it. We initially set this up to work on a User OU in AD as a new policy. Unfortunately, the lockout does not work, but the change we made in the timing of the screensaver is applying from the policy?

Had a quick google, and even tried a reg hack from Microsoft, but this didnt work either...
Has anyone else had this problem. We are running XP SP3 btw...

We have also checked other policies above this one, there are not any which concern this setting in the GPO though.

Thanks
Mark

Hi there - I seem to recall that you need to specify the screen saver name as well - have you tried that? Failing that you can try the Group Policy management console which allows you to run tests to double check that the setting is enforced for the people you are testing with.

For ours we have the password lock enabled in the default domain policy and just change the timeout per OU. This works fine on XP SP3 and worked fine on XP SP2.

Jonathan

[jamesb]

Might be worth running a RSoP on the users in question, it'll highlight any conflicts.

Also, is loopback processing enabled on any of the computers you're testing this on?

[_techie_]

Just tried specifying a screensaver that was in system32. Will try this first, before anything else.

It might be worth noting, that our teaching staff are "Domain Users", which could be causing a problem.

[_techie_]

Might be worth running a RSoP on the users in question, it'll highlight any conflicts.

Also, is loopback processing enabled on any of the computers you're testing this on?

How would you go about checking this? Never heard of RSoP before, and cannot check gpresult, when logged on as a staff member, since they do not have access to the command prompt...

Thanks for all your help so far!

Mark

[jamesb]

Just tried specifying a screensaver that was in system32. Will try this first, before anything else.

It might be worth noting, that our teaching staff are "Domain Users", which could be causing a problem.

Shouldn't be. By default all users in any AD are members of the Domain Users group.

[ArchersIT]

Just tried specifying a screensaver that was in system32. Will try this first, before anything else.

It might be worth noting, that our teaching staff are "Domain Users", which could be causing a problem.

This will not cause a problem as all our staff are domain users as well.

Cheers

Jonathan

[_techie_]

I think it might be something to do with another policy, which is causing a conflict. We currently have "lock computer" greyed out for staff, something to do with this might be causing the problem. Will investigate and report back.

[jamesb]

I think it might be something to do with another policy, which is causing a conflict. We currently have "lock computer" greyed out for staff, something to do with this might be causing the problem. Will investigate and report back.

If they can't lock the computer manually, then I'd be surprised if the screen saver setting could force it.

[_techie_]

Sorted w00p!! Was the "lock computer" button greyed out in another GPO after all!
Thanks chaps!