Auto Lock workstation not working anymore

[Sheridan]

Has anyone else noticed their GPO that locks workstations after a set idle time not working anymore?

 

We have the policy set in User GPO - in Administrative Templates\Control Panel\Personalization

 

- Enable screen saver - Enabled

- Password protect the screen saver - Enabled

- Screen saver timeout - Enabled and set to 600 seconds

 

What seems to happen is the screen saver tries to come on (screen blanks) and then reverts back to the desktop. I can replicate this by double clicking the default screen saver file C:\Windows\System32\scrnsave.scr and it does the same

 

All Windows 11 - does it on 23H2 and 24H2 as well

 

We just need the screens to lock, not actually enable a screensaver but this used to work?

[Olliedawg]

Try this - i believe this also locks the PC, will need to test that though to confirm. This is a computer policy however.

 

Administrative Templates/System/Power Management/Video and Display Settings

- Turn off the display (plugged)

- Turn off the display (battery)

[Sheridan]

I'll give that a go cheers. Am I misremembering the old way used to work?

[mikes]

I remember having a nightmare getting it to work, it just wouldn't apply. I ended up with a separate GPO I could apply to workstations. But then when I did it, staff showing presentations/assemblies would have their laptops lock half way through.

 

I had set Computer Config / Policies / Windows Settings / Security Settings / Local Policies / Security Options / Interactive Logon: Machine inactivity limit to 1200 seconds (20 mins)

[Olliedawg]

I'll give that a go cheers. Am I misremembering the old way used to work?

 

From what i've read it looks like it did previously work.

 

What Mikes suggested is the recommend option

[Sheridan]

I remember having a nightmare getting it to work, it just wouldn't apply. I ended up with a separate GPO I could apply to workstations. But then when I did it, staff showing presentations/assemblies would have their laptops lock half way through.

 

I had set Computer Config / Policies / Windows Settings / Security Settings / Local Policies / Security Options / Interactive Logon: Machine inactivity limit to 1200 seconds (20 mins)

 

Yeah I should have realised it wasn't working as the complaints about it locking whilst presenting had gone quiet

 

It looks like its broken in Windows 11 , as least as far as user based GPO is concerned. I'll have to do some restructuring to apply it by machine instead

[Sheridan]

Odd, tested using the Interactive Logon: Machine inactivity limit on some test PCs and it still doesn't lock! I set it to 5 minutes and even after several reboots it never locks

 

Wonder if the whole thing is broken or something is preventing it from locking

[Olliedawg]

Have you tried the one I suggested as a computer policy? I tried it on my laptop & it seemed to work

 

Administrative Templates/System/Power Management/Video and Display Settings

- Turn off the display (plugged)

- Turn off the display (battery)

[Sheridan]

Have you tried the one I suggested as a computer policy? I tried it on my laptop & it seemed to work

 

Administrative Templates/System/Power Management/Video and Display Settings

- Turn off the display (plugged)

- Turn off the display (battery)

 

That hasn't worked for me either - nothing seems to take any effect

[Oaktech]

I've just tested this...

 

You can add a key to the CU hive

 

Computer\HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion

 

DWORD

InactivityTimeoutSecs

Decimal Set timeout to same as screen off timer.

[TechMonkey]

GPRESULT on a device to check the correct setting is being applied?

[Sheridan]

GPRESULT on a device to check the correct setting is being applied?

 

All policies are applied (it’s a separate policy) and nothing seems to conflict

 

I wonder if something else is stopping it, like Netsupport or Sophie. It used to work and I’m not sure when it stopped working, very weird!

[jmak]

We've had an issue with users circumventing or policy with a Chrome extension called caffeine

 

Hopefully that's not the issue

[Sheridan]

We've had an issue with users circumventing or policy with a Chrome extension called caffeine

 

Hopefully that's not the issue

 

I doubt it, we have extensions blocked and it’s widespread affecting all users (separate policies for staff students and it staff)

[Sheridan]

This has got me baffled now, I've got this set in 3 places - Power policy to switch of the display after 5 minutes, the Interactive logon: Machine inactivity limit set to 5 mins and the user policy to run the screensaver after 5 mins and it never locks or switches off the display!

 

I did wonder if I'd disabled a service that is needed but apart from the usual xbox rubbish I'm only disabled the UEV service (and we don't use UEV)

Edited February 17, 2025 by Sheridan

[mikes]

I'll have a deeper look into our gpresult tomorrow but I remember having a nightmare getting it to work myself. Added a power plan, screensaver, interactivity, but you are def sure that if you do a group policy model for that user/computer it shows the correct gpo settings applied? I can't remember what else I did other than those 3 options.

[Hoyt]

Hey Lemmy, I mean Sheridan, have you got a spare machine you can test with? Maybe set it up and put the machine name in the same GP OU as the machines you are having trouble with but keep an eye on it to make sure nothing installs after you connect it. Then log on with a test account (that is in the same OU as your users) and let it sit. We have noticed this problem on Windows 10 workstations as well and it seems to be random for us. Unfortunately we don't have enough staff to be overly concerned with it.

 

I'm almost hoping we get audited one day so the school board will be forced to hire qualified staff, but the Wicked always prosper in this life...

[PotNoodleTech]

Subscribing to this as I think I am seeing it too only on Win 11 tho Win 10PCs seem ok?

[Sheridan]

Well I've made some progress with this - it looks like the power policy (setting the display to sleep after x minutes) is now working and that does lock the workstation. This didn't work before and it looks like someone had previously created a partial power policy which never slept the screen and that took priority! I really need to tidy up the years of my predecessor policies!

 

However the user policy just doesn't work at all - which is a shame as machine based works now, but is a bit more clunky to implement and of course doesn't follow the user around!

 

Still experimenting though! It was working on W10 but I've decimated the W10 stock down to zero now :-)

Edited February 19, 2025 by Sheridan

[chazzy2501]

create a scheduled task that triggers on inactivity... the program to start would be:

rundll32.exe user32.dll, LockWorkStation

Edited February 25, 2025 by chazzy2501