[Win10] Locking session after x mins on idle

[timbo343]

Back when we had windows 7, we had a scheduled task that ran on teacher and admin machines that locked the session after x mins of being idle. The command was %windir%\system32\rundll32.exe user32.dll LockWorkStation.

 

Now we're on windows 10, this command no longer works via schedule task, even with trying different users, system won't give any results either.

 

I've tried putting the command in bat file. The command successfully runs however when the bat file is in a schedule task it only runs with the user that is logged on. Ive tried changing the user to system, again it fails.

 

Is the windows 10 way of oing this now to put a password at screensaver, set the timeout against the screensaver?

 

Surely MS wouldnt have stopped the ability to do this.. oh hang in, it's MS, they gave us windows 10.

[Arthur]

Now we're on windows 10, this command no longer works via scheduled task

The following PowerShell script for locking workstations works fine for me on Windows 10.

 

# Helper functions for building the class
$script:nativeMethods = @();

function Register-NativeMethod([string]$dll, [string]$methodSignature)
{
   $script:nativeMethods += [PSCustomObject]@{ Dll = $dll; Signature = $methodSignature; }
}

function Add-NativeMethods()
{
   $nativeMethodsCode = $script:nativeMethods | % { "
       [DllImport(`"$($_.Dll)`")]
       public static extern $($_.Signature);
   " }

   Add-Type @"
       using System;
       using System.Runtime.InteropServices;
       public static class NativeMethods {
           $nativeMethodsCode
       }
"@
}

# Add methods here
Register-NativeMethod "user32.dll" "bool LockWorkStation()"
Register-NativeMethod "user32.dll" "bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight)"

# This builds the class and registers them (you can only do this one-per-session, as the type cannot be unloaded?)
Add-NativeMethods

#Calling the method
[NativeMethods]::LockWorkStation()

 

Source: https://foxdeploy.com/2016/12/15/locking-your-workstation-with-powershell/

[mrbios]

The following PowerShell script for locking workstations works fine for me on Windows 10.

 

# Helper functions for building the class
$script:nativeMethods = @();

function Register-NativeMethod([string]$dll, [string]$methodSignature)
{
   $script:nativeMethods += [PSCustomObject]@{ Dll = $dll; Signature = $methodSignature; }
}

function Add-NativeMethods()
{
   $nativeMethodsCode = $script:nativeMethods | % { "
       [DllImport(`"$($_.Dll)`")]
       public static extern $($_.Signature);
   " }

   Add-Type @"
       using System;
       using System.Runtime.InteropServices;
       public static class NativeMethods {
           $nativeMethodsCode
       }
"@
}

# Add methods here
Register-NativeMethod "user32.dll" "bool LockWorkStation()"
Register-NativeMethod "user32.dll" "bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight)"

# This builds the class and registers them (you can only do this one-per-session, as the type cannot be unloaded?)
Add-NativeMethods

#Calling the method
[NativeMethods]::LockWorkStation()

 

Source: https://foxdeploy.com/2016/12/15/locking-your-workstation-with-powershell/

Any powershell gurus able to make that check if pulsar.exe is running and only have it lock the session between a defined time period? (Though presumably the latter could be achieved as part of the task, but better to have it in the code if possible?)

[timbo343]

The following PowerShell script for locking workstations works fine for me on Windows 10.

 

# Helper functions for building the class
$script:nativeMethods = @();

function Register-NativeMethod([string]$dll, [string]$methodSignature)
{
   $script:nativeMethods += [PSCustomObject]@{ Dll = $dll; Signature = $methodSignature; }
}

function Add-NativeMethods()
{
   $nativeMethodsCode = $script:nativeMethods | % { "
       [DllImport(`"$($_.Dll)`")]
       public static extern $($_.Signature);
   " }

   Add-Type @"
       using System;
       using System.Runtime.InteropServices;
       public static class NativeMethods {
           $nativeMethodsCode
       }
"@
}

# Add methods here
Register-NativeMethod "user32.dll" "bool LockWorkStation()"
Register-NativeMethod "user32.dll" "bool MoveWindow(IntPtr hWnd, int X, int Y, int nWidth, int nHeight)"

# This builds the class and registers them (you can only do this one-per-session, as the type cannot be unloaded?)
Add-NativeMethods

#Calling the method
[NativeMethods]::LockWorkStation()

 

Source: https://foxdeploy.com/2016/12/15/locking-your-workstation-with-powershell/

Thank you, will try this tomorrow.

[timbo343]

Any powershell gurus able to make that check if pulsar.exe is running and only have it lock the session between a defined time period? (Though presumably the latter could be achieved as part of the task, but better to have it in the code if possible?)

And this would be great. Ive tried in the past to but not had much luck but that wasnt with powershell.

[Arthur]

Any powershell gurus able to make that check if pulsar.exe is running and only have it lock the session between a defined time period?

What sort of time period(s) were you thinking of? Just the school day?

[mrbios]

What sort of time period(s) were you thinking of? Just the school day?

 

Personally i need something like this that can lock idle computers after 3:15 if Sims has been left open. The powers that be won't let me lock pcs on a timeout outright...We tried once, everyone moaned about presentations they left up for the lesson and an idle timeout of 1.5hrs is basically pointless i guess it doesn't need to detect Sims though....I suppose I'd like to lock them if left idle no matter what is up!

[KibosJ]

We have them set to lock outright after 10 minutes. I have it setup as a screensaver that just runs the lock command, this way if they are running a video it doesn't lock. Seems to work okay for us, had no complaints.

[timbo343]

Still no joy with the powershell script, its doing the same as the bat file - the scheduled task will only run when the user is set to the user who is logged in. The user SYSTEM doesn't run the script however the schedule task says the tasks was run. Even using a specific user that I've got set in group policy - Logon as batch Job - the task doesn't run.

[ollyyllo]

Have you tried using group policy?

This policy applies to users but you could use Loopback Processing to target those machines mabye

 

User Configuration/Admniistrative Templates/Control Panel/Personalization

 

Enable screen saver = Enabled

Password protect the screen saver = Enabled

Screen saver timeout = Enabled

Number of seconds to wait to enable the screen saver

Seconds: 300

 

Edit: Just reread your post, this is what you were suggesting I think - can confirm this works on windows 10

Edited March 24, 2017 by ollyyllo

[timbo343]

Have you tried using group policy?

This policy applies to users but you could use Loopback Processing to target those machines mabye

 

User Configuration/Admniistrative Templates/Control Panel/Personalization

 

Enable screen saver = Enabled

Password protect the screen saver = Enabled

Screen saver timeout = Enabled

Number of seconds to wait to enable the screen saver

Seconds: 300

 

Edit: Just reread your post, this is what you were suggesting I think - can confirm this works on windows 10

Id like to set it per machine rather than per user. Group policy will only do this on a per user basis, not via a computer basis.

[mrwoberts]

@timbo343 How about the scheduled task running as the catchall 'USERS' group, or LOCAL SERVICE; I have that set on a task for one workstation and it triggers as expected. This isn't on a domain though, so that may be the difference.

[ollyyllo]

I have not tested it but wouldn't using Loopback Proccessing let you target any user logging onto just those machines?

[timbo343]

Local Service doesn't run however the group STAFF runs as this test user is a member of the staff group.

 

This means i can dish out the schedule task to machines and if the user is a member of $_Group, then the task will run - Happy Days.

 

Thank you to you all. Either the bat file or the powershell file runs as expected.