Allow students to lock computer

[petben]

Hello does anyone allow students to lock their computers. From what I can see the only option for the next user would be 'restart' if a student had walked away from their locked computer and not come back.

 

Any problems you can see with that? It is something we have just never enabled but has now come up as a security risk.

[clareq]

What's the risk? Lost work? We have backups.

[foofighterjim]

More risk with not allowing it, allows students to implement best practice.

[petben]

there were incidents of students doing unwanted things on other students' computers which they found logged on...

[Oaktech]

We don't at primary, and we didn't on suite computers at secondary, but we did at 6th form and in the LRC open access area where we expected students to be working for extended periods.

[petben]

OK, so if we do enable lock I also need to enable restart (which is currently disabled by GPO) the only thing I can see that is set is the GPO:

 

"Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands"

 

I dont really want ALL of those things, any way to pick just to allow restart?

[Davit2005]

The only issue I see is students locking instead of logging off at the end of a lesson then changing/forgetting their password (and the fun begins). If you have PCs shutting down at the end of the day will poss be less of a problem but jus something to be wary of.

 

But nope never implemented at any school for students only for staff.

[Rob_D]

As far as I can think, the worst that can happen is that the student who walked away without logging off loses their unsaved work when the computer is restarted and I guess some lost learning time/extra time to pick all the keys off the laptop for the incoming student.

You could mitigate time waiting for reboot with "switch user", but if you wind up with 3-4 students logged on at the same time it's going to effect performance, and it won't help with people losing work when the system is eventually rebooted/turned off.

 

We use Administrative Unlock to to avoid having to reboot the computer to kick someone off (works fine on win10 and 11 as far as we've seen).

https://4sysops.com/archives/restore-administrative-unlock-to-windows-7/

[Oaktech]

OK, so if we do enable lock I also need to enable restart (which is currently disabled by GPO) the only thing I can see that is set is the GPO:

 

"Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands"

 

I dont really want ALL of those things, any way to pick just to allow restart?

 

No, but it only affects your logged-on users start menu options. As soon as the logon screen is visible, anyone can shutdown or restart the machine; they just get a warning about anyone else logged in losing work that that they have to click past.

[mavhc]

I just have switch user enabled.

 

https://github.com/lithnet/idle-logoff/wiki/Group-policy-based-configuration for logging off idle users on shared computers

[petben]

As far as I can think, the worst that can happen is that the student who walked away without logging off loses their unsaved work when the computer is restarted and I guess some lost learning time/extra time to pick all the keys off the laptop for the incoming student.

You could mitigate time waiting for reboot with "switch user"

 

 

I dont think you can switch user from a locked computer.

[mavhc]

You can, if you have fast user switching enabled

[jthompson]

You can switch user on a locked computer. I don't remember us doing anything to have to enable it, but I might be wrong. User switching seems like the sort of thing that would be enabled by default.

 

Not allowing students to lock their computers feels to me like a recipe for pranking, and does rather go against the tide of best practice. If you've also got your computers going to sleep after a period of inactivity, you shouldn't end up with machines running all night because of locked users.

[EssentialRug]

Hello does anyone allow students to lock their computers. From what I can see the only option for the next user would be 'restart' if a student had walked away from their locked computer and not come back.

 

Any problems you can see with that? It is something we have just never enabled but has now come up as a security risk.

 

We managed to configure a 'sign out' button on the lock screen...I just had a Google and couldn't for the life of me find out where I had followed instructions to do so. You may be a better Googler than me!

[Rob_D]

We managed to configure a 'sign out' button on the lock screen...I just had a Google and couldn't for the life of me find out where I had followed instructions to do so. You may be a better Googler than me!

Does that allow the locked used to be signed out without needing a password or anything? Do you not get problems with people logging each other off?

 

[Edit]

 

Found what you're talking about here: https://social.technet.microsoft.com/Forums/en-US/0bd0346e-152a-4c3d-ae18-54f09cc9dd98/windows-10-logoff-from-locked-screen?forum=win10itprogeneral (last post).

That's pretty cool, but I'd be worried about people logging off each other's locked accounts (especially when we've got students in form rooms with the teacher's locked PC and no teacher).

Edited November 30, 2022 by Rob_D

[mavhc]

Only apply it to shared PCs

[EssentialRug]

Does that allow the locked used to be signed out without needing a password or anything? Do you not get problems with people logging each other off?

 

[Edit]

 

Found what you're talking about here: https://social.technet.microsoft.com/Forums/en-US/0bd0346e-152a-4c3d-ae18-54f09cc9dd98/windows-10-logoff-from-locked-screen?forum=win10itprogeneral (last post).

That's pretty cool, but I'd be worried about people logging off each other's locked accounts (especially when we've got students in form rooms with the teacher's locked PC and no teacher).

 

To be fair we only apply this for staff, and we had more issues with users signing into shared PCs, locking them and then wandering off for a week. All user data is backed up to OneDrive so no loss of any work by signing someone out. I've had it implemented for a little while now and had no complaints.

[mavhc]

I just go with click switch user, if the computer is then slow, you're allowed to restart it

[MartinByard]

We allow students to lock computers here, and to try and fend off issues with there being no "available" computers free to use we put a scheduled task in place with a trigger on screen lock that has a countdown timer for 20 minutes and then it forces a log off.

 

Task Name - On Workstation Lock

 

Start-Sleep 1200

Shutdown /l /f

On screen unlock (for when the student comes back) there is another scheduled task, which stops the previously mentioned task.

 

Stop-ScheduledTask -TaskName "On Workstation Lock"

[PotNoodleTech]

Nope. I can't think of anything worse than half the computers in the school all locked by random pupils that have moved on to a different room! No lock button here!!

[jthompson]

A locked computer needn't mean a computer that can't be used by somebody else, if that's the objection.

[PotNoodleTech]

But what does it achieve apart from encouraging pupils not to log off properly, but to leave the PC and walk out of the room?

[jthompson]

They may want or need to walk out of the room (toilet trip, printing to another room), or just across the room for some other reason, without leaving their workstation unlocked. Also, a hanging application may cause a user-initiated sign-out to cancel and return to the desktop after the class has left the room. In those instances, that user won't inadvertantly be left signed in and unlocked for any longer than the locking timeout.

 

This is one of those different-schools-different-expectations things, I think. We allow user locking here, but I don't see all that many locked machines whenever I'm working on a room, tbh, and it doesn't cause us any problems. YMMV.

[EssentialRug]

Locking screens is a really good practice to instill into people whether it be pupils or staff in my opinion Edited December 1, 2022 by EssentialRug

[msi_school]

We allowed students to lock screens and fast user switch at my last school, which allowed us to instill best practice and made helping classroom support easier.

 

However, we did find some machines with 10 or 15 students logged on at the end of the day which caused slow downs, this was partially resolved by forcing a shutdown every evening which also made the site manager, finance manager and eco committee happy.