Screensaver password timeouts.

[snakepottery]

To increase security as teachers have a habit of eaving workstations logged in, in Sims,with a students details on the screen for all the kids to look at, I have set a policy to switch to screen saver after 5 minutes and require their password to log back in. Fine so far, however as the policy is applied to all staff, and when they login in the classroom during lessons and put up a spread sheet or something, it wil of course goto scrensaver after 5 mins which is a pain. Is it possible to control when it goes to saver or only go to saver if you are inactive in certain progs?

Any ideas anyone? What do you guys/girls do?

 

Cheers

 

Andy

[fooby]

We applied the same thing 5 minutes, teachers winging for a few months then they just got used to it.

 

Its just a pain barrier, get the director / head of ict or your data protection officer to send out an email / letter telling the reasons why (use scary long legal words)

 

Eventually they will give up moaning.

 

Incidentally if there is a popup menu (the start menu should do this) open, then the screensaver wont activate

 

fooby

[snakepottery]

Thanks Fooby, whinging just about sums it up!!! Everytime I try to make the network more secure to stop any Tom Dick or Harry, or malevolent pupil deleting all the teachers work or worse still dropping porn onto their home directories all I get is moaning and complaints. Maybe I should delete a load of stuff from the network just to prove a point?!!!

Tempting eh?

I'll suggest that they leave the start menu in place

 

Thanks

 

Andy

[Norphy]

I've been having the same argument myself just recently. One of the English teachers (who I previously got on quite well with) is probably never going to speak to me again after she tried to shout me down in a meeting and just got made to look stupid when the SMT backed me up

 

At the moment I'm trying to find a compromise but so far haven't suceeded

[snakepottery]

I'm plodding my way around Google to see if there is a way to stop the policy from being applied to specific machines, ie the ones that are connected to the whiteboards as these are the ones causing the grief.

Not found anything yet though. I did find something about write protecting a specific registry key to stop GPOs from overwriting it, looked a little dubious to me though!

I suppose I could put the machines into a specific OU which doesn't have the policy applied? Or is it a User policy? Or shall I go and have a beer as it's Friday!!!!

 

Cheers

 

Andy

[ChrisH]

I would put them all in their OU or a sub OU of the OU they are in now and add a policy and adjust to your needs.

[sahmeepee]

You might want to try sticking Caffe1ne v1.5 into the startup items for all/some users on your whiteboard PCs. (I haven't tested the software myself, so I can't vouch for it)

 

Personally I just increased the timeout slightly (to 15 mins i think) in group policy for the whiners. I'd rather not make exceptions for individual people as it makes GPMC all untidy ( ), but sometimes it's worth making exceptions for an easy life.

[ChrisH]

I take it is a user policy. In that case you could use a loopback policy so it only affects them when they log onto certain machines.

[plexer]

Caffeine works by simulating a shift key press every 59 seconds. Can just imagine the consequences that could have as a user is typing and random letters get capitalized or does it only kick in when there is no activity at all?

 

Ben

[E1uSiV3]

why not apply the screensaver policy to a group with all the comps you wish to protect with screen savers, that way all the comps not in the group (ie the whiteboard ones) will nto have the policy. I do this for software installations so i can push out on a per computer basis (great for keeping count for licensing purposes)

[snakepottery]

Yes it's a user policy so therefore can't be applied to machines (I believe)

 

I like the idea of the loopback policy as I already use that for the remote access terminal server and it works well. I can set up an OU for the whiteboard machines and loopback the screensaver policy in it. Should work OK and will stop the whinging! Well maybe!

 

I'm setting the password security so they have to change passwords every 3 months and cannot use their old one!! That should really get them moaning!! It's quite a sport this Teacher Bating isn't it!!

Thanks chaps!

 

Andy

[fooby]

I'm still from the security over complaints way. We have an approachable principal and after talking with them they agreed (start scaring them with the possibility of students accessing confidential data and that there would be lawsuits) this way they agree. And coming from the top down you are ok.

 

Personally, I would have it lock after 2 minutes, the amount of times teachers leave the desk with sims.net open / their my docs folder with all their work in :@

 

When I was a student, if you left your pc logged on and walked away the nice helpful students in the suites would lovingly delete all your home folder. This way you learned the hard way to logoff properly / don't leave things unattended. Oh and backups?.. no chance :/

 

fooby

[Mintsoft]

I'm still from the security over complaints way. We have an approachable principal and after talking with them they agreed (start scaring them with the possibility of students accessing confidential data and that there would be lawsuits) this way they agree. And coming from the top down you are ok.

 

Personally, I would have it lock after 2 minutes, the amount of times teachers leave the desk with sims.net open / their my docs folder with all their work in :@

 

When I was a student, if you left your pc logged on and walked away the nice helpful students in the suites would lovingly delete all your home folder. This way you learned the hard way to logoff properly / don't leave things unattended. Oh and backups?.. no chance :/

 

fooby

 

We used to do Ctrl+A, Ctrl-C, ctrl-V ctrl-V ctrl-V ctrl-V ctrl-V ctrl-V ctrl-V ctrl-V ctrl-V and duplicate their stuff about a billion times ^_^ Ahh the childish days, where have they gone

[Shiny_Guru]

We have successfully implemented this using loopback processing and user policies, our arrangment goes like this

 

All non teaching staff have passworded screen saver after 5 mins applied by the NonTeachingStaff OU group policy

 

All teachers have the screen saver after 45 mins (our lesson length) applied by the Teacher OU group policy

 

then we use loopback processing on all machines in non teaching rooms to enforce a passworded screen saver after 5 mins

 

This means that all non teaching staff have a 5 min delay wherever they are, teaching staff have a 5 min delay out of the classroom where they are most likely to have sims open, but are allowed a full period of inactivity if they are in a teaching room.

 

this works for us and has shut up the teachers who put a projection on the board for the class to copy down and don't touch the machine for the rest of the lesson - it is a bit of a compromise, 45 mins is far to long, but it is leaps and bounds ahead of the state we were in a couple of months ago with no screen saver at all - we now have a big red screen with a padlock through it and instructions to press Ctrl-alt-del to continue.

 

We now even have people logging off when they are not using the machine because it locks the rest of their department out anyway :twisted:

[Michael]

There was a pupil (not at my school) who changed some AutoCorrect Options in MS Word, so everytime the teacher wrote "the" or "it" a swear word appeared instead!

 

As for securing workstations, all our workstations lock after 3 mins of inactivity. All teachers are also forced to have 7 characters or longer passwords and not surprisingly, we've had minimal issues from unauthorised visitors or pupils accessing staff only areas.

[plexer]

How are you forcing only teachers to have 7 character long password when the password policy applies at domain level? or did I miss something in the previous thread?

 

Ben

***off to check it***

[Nij.UK]

thats a good point, i would bet money on the fact that Password policies are applied at domain level....

 

Im guessing there is some sort of trust between the admin and cur networks

[ajbritton]

You could cobble together an AutoIT script which watches for the presence of high risk applications being open and shortens the ScreenSaverTimeOut registry value, or spots whiteboard apps and disables screensaver. The script could be set to loop forever but sleep for 5 seconds between checks.

Opt("WinTitleMatchMode", 2)     ;1=start, 2=subStr, 3=exact, 4=advanced

Do
$MaxTimeout = 15 * 60	;15 minutes
if WinExists("SIMS") then
	$MaxTimeout = 1 * 60	;1 minute
ElseIf WinExists("WhiteboardApp") then
	$MaxTimeout = 30 * 60	;30 minutes
EndIf

RegWrite("HKEY_CURRENT_USER\Control Panel\Desktop", "ScreenSaveTimeOut", "REG_SZ", $MaxTimeout)

Sleep(5000)
Until 1 = 0

 

NB - This script has not been tested !!

[Michael]

@plexer - Password policies are set at domain level, however for pupils I block policy inheritance.

 

You can then specify specific password requirements for an OU - Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policies

[ajbritton]

@Michael - Surely that would set the password policies for user accounts on the computers, not the domain.