Lock PC after inactivity

[Archipelego1]

I've done a search of the forums but haven't been able to find a definitive answer to the following : How can I enable to PC to lock after a certain amount of activity? On Windows 7, we have something similar to : https://community.spiceworks.com/topic/808517-lock-screen-using-group-policy-without-setting-a-screen-saver-server-2012 setup, which works fine. However this setting doesn't seem to be working on Windows 10.

 

Is this to be expected, do you do this any differently? We have the latest release of 10.

[mavhc]

I just set a power policy for them to standby, and have "lock when resuming from standby" gpo applied.

 

Computer>Policies>Admin>System>Power Management

[LeMarchand]

I just set a power policy for them to standby, and have "lock when resuming from standby" gpo applied.

 

Computer>Policies>Admin>System>Power Management

 

This is what we do. [sarcasm]The staff love it[/sarcasm].

[6Foot2]

This is what we do. [sarcasm]The staff love it[/sarcasm].

 

Far too often our staff leave themselves logged on, the stations unattended with students in the room!

 

No sarcasm.

 

[Archipelego1]

Is there any other way? I'd prefer not to standby the PC's, just lock the screen when not active.

 

That way services and apps can still run in the background

[6Foot2]

Is there any other way? I'd prefer not to standby the PC's, just lock the screen when not active.

 

That way services and apps can still run in the background

Your Classroom Management software will probably do it (if you have it)

 

Impero, NetSupport, Lanschool, etc

[LeMarchand]

Is there any other way? I'd prefer not to standby the PC's, just lock the screen when not active.

 

That way services and apps can still run in the background

 

Enable screensaver, password protect and set appropriate timeout should do it.

[ADMaster]

Enable screensaver, password protect and set appropriate timeout should do it.

 

And you can do that with GPP power options.

I have found the enforcing the password on resume must be done in the power management section of administrative templates. However all of your timeouts / power plan options can be done nicely with GPP.

[Koldov]

Just looking through Google and found this (haven't tried it yet). Looks like the OP here was looking for a screen lock 'WITHOUT' screensaver for some reason, but the answer given leads to an article that suggests a GPO that invokes the screensaver and works 2012/8.1 and above. Also looks like he got into trouble applying it to the wrong OU, but seems to suggest it works on Win 10 computers...

 

I'm guessing the password protected screensaver is the thing that 'locks' it though?

 

https://social.technet.microsoft.com/Forums/en-US/7c05a69f-931b-4358-864b-c8551b6c1af0/group-policy-for-windows-mainly-7-and-few-10-clients-that-locks-the-computer-without-screen-saver?forum=winserverGP

 

Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options

 

Interactive logon: Machine inactivity limit.

[Garacesh]

Is there any other way? I'd prefer not to standby the PC's, just lock the screen when not active.

 

Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security Options

Interactive logon: Machine inactivity limit

 

IIRC, setting that to a time threshold without a screensaver defined just locks the PC once the threshold has been reached.

 

Edit: Ninja'd by @Koldov!

[Frugal]

Would watching a video count as being inactive?

[Garacesh]

Would watching a video count as being inactive?

 

IIRC Applications running fullscreen disable timeouts.

Probably varies by application though.

[FN-GM]

Would watching a video count as being inactive?

YouTube, VLC and Windows media player don't. Think it is anything full screen.

[Sheridan]

The way we did it was to set a screen saver by group policy, and use the Policy setting 'Force specific screen saver' to point to %windir%\system32\rundll32.exe user32.dll,LockWorkStation

 

With the screen saver timeout set to 20 minutes, and the 'Password protect the screen saver' policy setting it means the PC locks after 20 minutes. Works a treat.

[KK20]

don't take me as being pedantic; do you mean lock after a period of ACTIVITY or inactivity? Screensaver is the obvious choice for inactivity, just use a benign or transparent screensaver if you don't want it to LOOK like a screensaver. If you mean lock after ACTIVITY (the inverse of a screensaver almost) then you will need to look at scheduled tasks running regularly, ironically you will look at activating something on "task does not run in xxx time" based on inactivity (which denotes the task not activating because the computer being in use). The "does not run" can invoke a screensaver manually thus locking the computer.

[Archipelego1]

The way we did it was to set a screen saver by group policy, and use the Policy setting 'Force specific screen saver' to point to %windir%\system32\rundll32.exe user32.dll,LockWorkStation

 

With the screen saver timeout set to 20 minutes, and the 'Password protect the screen saver' policy setting it means the PC locks after 20 minutes. Works a treat.

 

Tried this, for us, it works on Windows 7 but not on 10.

[KK20]

you could just change the registry directly if you wish.

 

We still use a registry workaround to run a W10 slideshow screensaver at the CTRL-ALT-DEL screen (this wont help you in your particular endeavour but may give you a starting point)

 

https://support.microsoft.com/en-us/help/185348/how-to-change-the-logon-screen-saver-in-windows

 

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]

"ScreenSaveTimeOut"="120"

"ScreenSaveActive"="1"

"SCRNSAVE.EXE"="C:\\WINDOWS\\system32\\.scr"

 

[HKEY_USERS\.DEFAULT\Control Panel\Screen Saver.Slideshow]

"ImageDirectory"=""

"PaintInterval"=dword:00000000

"ChangeInterval"=dword:00001770

"DisplayFilename"=dword:00000000

"MaxScreenPercent"=dword:00000064

"DisableTransitions"=dword:00000001

"AllowStretching"=dword:00000000

"AllowKeyboardControl"=dword:00000001

"MaxFailedFiles"=dword:000003e8

"MaxSuccessfulFiles"=dword:00010000

"MaxDirectories"=dword:000000c8

 

[HKEY_USERS\S-1-5-19\Control Panel\Screen Saver.Slideshow]

"ImageDirectory"=""

"PaintInterval"=dword:00000000

"ChangeInterval"=dword:00001770

"DisplayFilename"=dword:00000000

"MaxScreenPercent"=dword:00000064

"DisableTransitions"=dword:00000001

"AllowStretching"=dword:00000000

"AllowKeyboardControl"=dword:00000001

"MaxFailedFiles"=dword:000003e8

"MaxSuccessfulFiles"=dword:00010000

"MaxDirectories"=dword:000000c8

 

Edited December 13, 2017 by KK20

[Sheridan]

Tried this, for us, it works on Windows 7 but not on 10.

 

Odd, it seems to be working her for us on W10 Edu 1607/1703.

[mullet_man]

Am finding this works fine on Windows 10.

 

 

Locks the screen after 10 mins, and goes straight to lock screen. You don't need to specify a screensaver.

[CHiLL]

This is how we do it:

 

User Configuration > Policies > Administrative Templates > Control Panel > Personalisation

Enable screen saver: Enabled

Password protect the screen saver: Enabled

Screen saver timeout: Enabled - 600 seconds.

[Ertech]

is there a way to force the screensaver to start immediately when locked manually (Win+L) by the end-user?

[LeMarchand]

is there a way to force the screensaver to start immediately when locked manually (Win+L) by the end-user?

 

I use this on my PCs. The screensaver and mute volume bits still work, but it doesn't seem to pause Spotify any more. https://github.com/ukanth/monitores

[chazzy2501]

you could also setup a scheduled task to trigger after a period of inactivity then tell it to run something like "rundll32.exe user32.dll,LockWorkStation" (this works great) but tasks can be deployed via GPP.

 

Also for bonus points the task can be setup to run only with certain user groups, or when certain networks are available. (so only at work not at home, or when teachers not slt) super handy.

[Ertech]

I have a GPP ScreenSaver/LockScreen policy but the ScreenSaver does not come up when the end-user manually locks the W10 Device - It works fine with W7 devices.

 

Am I missing something?