Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a group policy that forces workstations to lock after X minutes. But from time to time I would like to suspend the law of the GPO. I already have a tiny Auto-It script that clicks the Control Key every two minutes and have looked at the registry changes that would need to be made to prevent the locking in a less obtrusive to the user way. With no time to spare on such efforts, I thought I would ask the wonderful serverfault community, has anyone run across a (preferably open source) utility that would prevent a workstation from locking?

Thanks

share|improve this question
    
Is this just for temporary usage, like presentations? Or do you need to disable it for the entire computer. –  Zoredache Oct 1 '09 at 21:40
    
Can you change anything in the domain or are you a standard domain user? –  Massimo Oct 1 '09 at 22:03
    
Yes this is for temporary use. Most of the time, for remote support sessions, when I have a vendor remoted into one of their systems working on it. Even if I could change the group policy, I would rather not. –  Nathan Hartley Oct 2 '09 at 14:11
    
I was hoping someone knew of a little utility to do this. <shrug> looks like I might have to write this one myself. No time for this right now though... –  Nathan Hartley Oct 2 '09 at 14:51
    
If you can change the GPOs, you can put the user accounts for remote support technician in a specific OU and apply a policy to that OU which disables workstation locking. –  Massimo Oct 2 '09 at 17:14

5 Answers 5

up vote 3 down vote accepted

The REG file below disables the screen saver. Including the default Windows screen saver which always locks the screen and is engaged when the user's screen saver is set to "none".

To defeat Active Directory, these settings must be made each time AD refreshes and before the next screen saver time out.

Turns out, I was just struggling with the default screen saver and only had to remove the SCRNSAVE key, so I haven't pursued a good way to continually make these changes.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"ScreenSaveActive"="0"
"ScreenSaverIsSecure"="0"
"SCRNSAVE.EXE"=-
share|improve this answer

GPOs exist exactly for this purpose: enforce configuration settings on domain computers. They would be quite useless if they were avoidable.

If you can't modify the policy and/or various other domain parameters (OU of the user account you're logging on with, etc.), there's nothing you can do other than moving the mouse or hitting keys. Your only option is to log on to the workstation using a local user account, to which the domain's user policies (including screen saver ones) are not applied.

share|improve this answer
1  
I know for sure that the user account has the ability to disable the workstation locking. They just need something to make a handful of registry changes on their behalf. However, these changes must be redone following each Group Policy refresh. –  Nathan Hartley Oct 2 '09 at 14:17

I took the opportunity to expand a bit on Nathan Hartley's excellent answer by producing a Powershell script that will clear the ScreenSaveActive setting every 10 seconds. Trivial to do in a single line but I obviously had to over-complicate it and gave it pretty progress bars for the wait time and such (feeping creaturism!).

$IntervalSeconds = 10
$IntervalMilli = $IntervalSeconds * 1000
$counter = 0
$LastWrite = ''
$StartTime = get-date
$FudgeMilli = 20
while ($true) {
    $counter++
    $LastWrite = Get-Date -uformat '%T'
    Set-ItemProperty -path 'HKCU:\Control Panel\Desktop' -Name 'ScreenSaveActive' -Value 0
    Write-Progress -id 0 -Activity "No Screen is Safe" -PercentComplete $($Counter % 100) -Status "Last Write: $($LastWrite) Write Count: $($Counter) Elapsed: $($($(get-date) - $StartTime).ToString())"
    for($i = 1; $i -le 100; $i++) {
        [INT] $MilliSecondsLeft = $(($IntervalMilli - ($i * $intervalMilli/100)))
        [INT] $SecondsLeft = ($MilliSecondsLeft * .001)
        $PercentComplete = (($i * $intervalMilli/100)/$IntervalMilli) * 100
        Write-Progress -id 1 -ParentId 0 -Activity "Lying in wait for $($IntervalSeconds) Seconds" -status 'ZZZzzzz...' -PercentComplete $PercentComplete -SecondsRemaining $SecondsLeft
        Write-Progress -id 0 -Activity "No Screen is Safe" -PercentComplete $($Counter % 100) -Status "Last Write: $($LastWrite) Write Count: $($Counter) Elapsed: $($($(get-date) - $StartTime).ToString())"
        start-sleep -Milliseconds $($($IntervalMilli / 100) - $FudgeMilli)
    }
    Write-Progress -id 1 -ParentId 0 -Activity "Lying in wait for $($IntervalSeconds) Seconds" -status 'Snerkt!' -PercentComplete 100 -Completed
}

It doesn't do exactly the number of seconds (which is why where is a Fudge Factor built in to adjust the interval timing closer to reality) and I didn't spend a ton of time to optimize every last detail.

Hopefully someone may find this of use down the line.

share|improve this answer
    
Overkill, but I like it. One for the toolbox ;-) –  Bart De Vos Aug 3 '12 at 18:00
    
Even with ScreenSaveActive set to 0, if the SCRNSAVE.EXE key is present but empty, Windows will use the default screen saver which always locks the screen. So if it is blank, you will also want to delete the SCRNSAVE.EXE key. –  Nathan Hartley Aug 10 '12 at 20:48

I always find this technology here quuuite useful.

share|improve this answer
    
I loved this WTF when I read it and it is even more funny now that it would apply in this scenario! –  Vaccano Oct 1 '09 at 22:11
    
It's funny cos its true. We've done something similar in our office when a server out of our control had super-restrictive remote desktop timeout policies. –  Mark Henderson Oct 1 '09 at 22:16

Assuming that you let the users select which screensaver they can use, you could temporarily select "none" as your screensaver and the workstation won't lock.

share|improve this answer
    
This was something I actually had to learn from the users when researching why their workstations never locked. I had to remove their ability to select which screensaver they could choose, since I couldn't find a way to remove just 'none'. –  GregD Oct 1 '09 at 21:55
1  
Nope. If the policies for screensaver timeout and password lockdown are enabled, it will lock. Without any screensaver. I Tested it personally when researching workstation lockdown for a customer. –  Massimo Oct 1 '09 at 21:57
    
In that case, you could set a GPO and assign it to just that computer that overrides just that property that policy, enable/disable it when necessary? I don't know if it deserved the -1, as it technically did answer the question, just not all the information was provided. –  Mark Henderson Oct 1 '09 at 21:58
    
Tested it as well. In our environment, the workstation will not lock when 'none' is selected as a screensaver. –  GregD Oct 1 '09 at 21:58
    
Windows XP in a Windows 2003 domain, we wanted to let users choose their own screensaver but enforce workstation lockdown. We spent a whole day testing it... I'm quite sure the computer still got locked even if the user choosed no screensaver. –  Massimo Oct 1 '09 at 22:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.