Windows – Enforcing lock screen after idle time via GPO

group-policywindows

I run a network of computers and I would like enforce a GPO which locks the screen after a predefined idle time. I can't find this setting, I can only find a screen saver idle time setting, how can I get a log-out screen accomplished?

Thanks.

Best Answer

Actually I found (and tested) in Windows Server 2012 R2, under:

Computer Configuration>Policies>Windows Settings>Security Settings>Local
Policies>Security Options>

And open item Interactive logon: Machine inactivity limit

Explanation:

Interactive logon: Machine inactivity limit.

Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.

Default: not enforced.

Related Solutions

Enabling remote desktop via GPO

The setting for this in Group Policy is in:

Computer Configuration -> Administrative Templates -> Windows Components ->
Terminal Services -> Allows users to connect remotely using Terminal Services

Set to enable to allow terminal services (RDP) connections, disable to disallow.

This assumes that you are using an account to RDP to these machines that is allowed RDP access, such as a member of the administrators group.

Bypassing GPO for “set time limit for disconnected sessions”

I used to work in an environment that mandated a one minute disconnected session limit. It drove me crazy. I can't tell you how many times an install or config was killed in the middle when I lost my connection to the server. I did however eventually find a workaround. Change the following registry value as shown:

Key:   HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
Value: MaxDisconnectionTime
Type:  DWORD
Data:  0

This is the value set by the policy "Set time limit for disconnected sessions". It's stored as a millisecond value. If you set it to zero before connecting to the server, your session will not be disconnected. You'll need to change it back when you are done, though. Also keep in mind that this generally requires you to have local administative rights on the subject server but it sounds like you ARE the admin there.

Best Answer

Related Solutions

Enabling remote desktop via GPO

Bypassing GPO for “set time limit for disconnected sessions”

Related Topic