GPO screen lock Win10 pro

[lkaylor]

Hiya,

I am currently working on a GPO to force a lock screen after some minutes of inactivity. By using the following settings I have a GPO that works to display a screen saver after a few minutes but still no lock screen. Has anyone got any ideas please?

[Arthur]

Has anyone got any ideas please?

The following GPO works fine for me on Windows 10 (even without a screensaver set)...

 

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies/Security Options > Other > Policy Setting

[b]Interactive logon: Machine inactivity limit[/b] = 600 seconds (or whatever you want it to be)

 

I keep user and computer-based GPOs separate (rather than mix them together like in your screenshot).

 

Edited April 27, 2018 by Arthur

[lkaylor]

Thanks Arthur, but that is what I have also done in that GPO ( I think you should be able to see that at the top of the previous image) and it doesn't seem to take affect.

[Arthur]

it doesn't seem to take effect.

Is the computer you are testing it on located in the same OU as the GPO (since it looks like your Windows 10 computers are in a completely different OU where the screensaver policy doesn't apply)?

Edited April 27, 2018 by Arthur

[lkaylor]

Hi Arthur, thanks for the update. I am going to try again, starting by scratch and just have the security setting policy (not the screen saver) as you have suggested.

I will move the GPO to the correct OU after testing and verifying it works.

I will test with the new configuration and update this post.

[lkaylor]

I'm afraid that didn't work. Screensaver did activate with previous settings but I don't get any change now.

[clareq]

Your test OU - does it contain users or computers?

[lkaylor]

Just computers.

[NetworkServices]

I recently set up the same thing. I could only get Windows 10 machines to auto-lock using a computer policy. Windows 7 worked with user policies.

[lkaylor]

Hi 'NetworkServices' your GPO is the same config as mine (except the timings). I don't understand.

[Arthur]

I'm afraid that didn't work.

Do you have any WMI filters attached to the GPO which would prevent it from applying?

 

Also, does "Authenticated Users" or "Domain Computers" have read permissions on the GPO?

[NetworkServices]

Hi 'NetworkServices' your GPO is the same config as mine (except the timings). I don't understand.

 

You're not running a PowerPoint or playing a video on the offending test machine, are you? It won't automatically lock if you are.

[lkaylor]

Hmm? maybe not then re the read permissions. How can I check please?

There are no programs playing /in use btw.

Edited April 30, 2018 by lkaylor

[NetworkServices]

Have you tried unplugging the mouse? It's a long shot but sometimes optical mice (particularly inexpensive ones) suffer from wandering when they're stationary. This would be enough to prevent the machine locking.

[lkaylor]

It's a laptop with mousepad. The screen saver image will appear but does not lock the user out.

[Arthur]

Hmm? maybe not then re the read permissions. How can I check please?

If you go to the Delegation tab of your GPO, do the permissions look similar to the screenshot below?

 

[lkaylor]

After some more tweaking i found that 'disabling' " Interactive logon: Do not require CTRL+ALT+DEL "

In the following GPO settings worked!

 

 

Computer

Configuration (Enabled)-Policies-Windows Settings -Security Settings -Account Policies/Account

Local Policies/Security

Interactive Logon

[TABLE=class: info]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[/TR]

[TR]

[TD][/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Interactive logon: Do not require CTRL+ALT+DEL [/TD]

[TD]Disabled[/TD]

[/TR]

[/TABLE]

 

 

It's not what I wanted ideally but will help with upcoming GDPR. Thanks for all suggestions.

[lkaylor]

I've revisited this post as I really thought it had worked but in fact does not. It is only the screen saver that activates in the chosen time, screen lock does NOT work. On further research I see that it may be that some GPOs will not work on Win 10 pro. Is this correct? Am I wasting my time?

many thanks in advance.

[gmonks]

I've revisited this post as I really thought it had worked but in fact does not. It is only the screen saver that activates in the chosen time, screen lock does NOT work. On further research I see that it may be that some GPOs will not work on Win 10 pro. Is this correct? Am I wasting my time?

many thanks in advance.

 

You have to make sure you have the correct .ADMX files for the version of Windows 10 you're using.

 

The .admx files for version 1803 can be found here.

 

I have the lock screen working in 1803 with the following settings:

 

Group Policy – Computer Configuration –Policies – Administrative Templates – Control Panel – Personalization – Force a specific lock screen and logon image, prevent enabling lock screen camera, prevent changing lock screen and logon image

 

You also need to ensure permissions are in place so the image can be viewed. My lock screen photo is in the NETLOGON folder on the DC.

[lkaylor]

Hi gmonks, thanks for your reply. I have now updated admx files and after testing still only get the screensaver, not a lock out.

[lkaylor]

Hi again, I have created a 'fresh' gpo following gmonks config suggestion. Group Policy – Computer Configuration –Policies – Administrative Templates – Control Panel – Personalization – Force a specific lock screen and logon image, prevent enabling lock screen camera, prevent changing lock screen and logon image. Now nothing is happening. Where would one set the inactivity timeout as I see the user GPO config are now obsolete?

[lkaylor]

Update, I have now tested on version to Windows 10 Edu as I couldn't get the lock screen gpo to work on Windows Pro. However, it still does not work. I am running out of things to try.

[gmonks]

Update, I have now tested on version to Windows 10 Edu as I couldn't get the lock screen gpo to work on Windows Pro. However, it still does not work. I am running out of things to try.

 

Apologies, I read your post wrong.

 

Try this:

 

Computer Configuration – Policies – Windows Settings – Security Settings – Local Policies – Security options – Interactive Logon Machine Inactivity limit

[lkaylor]

Thank you gmonks. Still no log out though. The screen goes black after inactivity time but with a wiggle of the mouse I am back on the user desktop. These are laptops I am working with. Do you think there is something I could change with power settings perhaps?

[lkaylor]

I had a fresh look at this yesterday. I did some more experimenting and once I applied the GPO to a root OU it seemed to work.