Server 2012R2 other users tile

On the suggestion of checking the Power Management settings by @joeqwerty I created a new Power Plan with the following settings:

• Display -> Turn off display after -> On battery (minutes): 0
• Display -> Turn off display after -> Plugged in (minutes): 0

I set this as the active power plan, and applied the GPO. After 25 minutes the machines are no longer automatically locking.

Here are the full steps for creating this:

1. In Group Policy Management Editor, edit the target GPO
2. Go to Computer Configuration\Preferences\Control Panel Settings\Power Options
3. In the right pane, right click and select New -> Power Plan (At least Windows 7)
4. In the Advanced settings tab, select the Create action
5. Enter a new plan name (e.g. "Don't lock")
6. Select Set as the active power plan
7. Expand Display -> Turn off display after
8. Change On battery (minutes) to 0
9. Change Plugged in (minutes) to 0
10. Click Apply, OK
11. Apply the GPO to the target machine(s)

How does the Event-Forwaring actually work? Is it possible and useful to use Network Load Balancing (NLB)?

Event forwarding depends on WSMan/WinRM (windows remote management service). For domain joined scenarios, this uses Kerberos as a default for authentication and encryption, which requires a service principal name (SPN). SPNs are meant to be unique. Therefore, no two domain joined computers should be permitted to register the same SPN for their computer accounts/identity, which makes load balancing with default setup unworkable. While there are some guides on configuring IIS to use a specific service domain account (instead of computer account), and letting a pool of IIS web servers share that service account, WSMan/WinRM is more of core OS service. It seems to be heavily tied into running as the Network Service account of a machine, which in turn depends on the computer's built-in machine account and SPN. Hence, it's non-trivial to load balance windows event forwarding.

Most references I've seen on the topic suggest a number of work-arrounds, such as:

• Directly use GPO subscription settings to switch/load balance which specific event collector servers are used based on site topology, etc.
• Split subscriptions settings into different roles, e.g. one for System and Application logs, the other for Security, and via GPO, configure clients (log sources) to get subscriptions from both servers.

Neither of the above provide HA, just splitting load. For HA, I've seen a recommendation to set 2 servers with the same subscriptions, but this duplicates the events sent (and wastes bandwidth, etc).