Windows 10 InactivityTimeout ignoring GPO, Locking Screen after 5 minutes no matter what

group-policysettingswindows

We're having a problem where a subset of PC's lock after 5 minutes, but the GPO for "Interactive logon: Machine inactivity limit" is set to 900 seconds (15 minutes). So far I've tried the following, but nothing has solved it:

Run "gpresult /z > gpresult.txt, searched through for any strings matching Sleep, Timeout or Inactivity, and any Values matching "300" (5 minutes in seconds)

Put the Computer and User Object in a OU with no inheritance, ran gpupdate and removed the local GPO store from %systemroot%\System32\GroupPolicy\DataStore\0\SysVol\CompanyName.com

Set the following settings:

  • Computer COnfiguration > Policies > Administrative Templats > System > Power Management -> Sleep Settings
  • Specify the unattended sleep timeout (on battery) -> 0
  • Specify the unattended sleep timeout (plugged in) -> 0
  • Allow Applications to prevent Automatic sleep (on battery) -> Enabled
  • Allow Applications to prevent Automatic sleep (plugged in) -> Enabled

Creating a new Power Policy based on High Performance with a higher Sleep Timeout and Screen Lock.

Creating a new Policy

User Configuration/Administrative Templates/Control Panel/Personalization/

  • Enable screen saver – Enabled
  • Password protect the screen saver – Enabled
  • Screen saver timeout – Enabled, 900 seconds

Setting the Registry to Enable Unattended Sleep Timeout setting in registry:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7
  • Attribute Value 2
  • Increase Unattended Sleep Timeout to 900+

I'm certain that since putting the objects into a OU with inheritance denied doesn't fix it means that it's either a Registry Setting, or a GPO setting which is not removed by removing the Policy itself from the object.

Best Answer

Did you try checking the corresponding Event IDs ?

IDs were posted here: https://stackoverflow.com/questions/11385164/eventviewer-eventid-for-lock-and-unlock

maybe you get more information, what is happening exactly, by the eventlog entries.

(I am new here and can only "answer" and not "comment" - hope, this is ok)

you can also temporarily move one workstation in an OU in the AD, where no GPO is applied to check.

Related Topic