2

We have some PCs that lock after five minutes, but the GPO for "Interactive logon: Machine inactivity limit" is set to 900 seconds. I have tried the following, but nothing has solved it:

Run gpresult /z > gpresult.txt, searched for strings matching sleep, timeout or inactivity, and any values matching "300" (five minutes in seconds)

Put the computer and user objects in a OU with no inheritance, ran gpupdate and removed the local GPO store from %systemroot%\System32\GroupPolicy\DataStore\0\SysVol\CompanyName.com

Set the following policy settings:

  • Computer Configuration > Policies > Administrative Templates > System > Power Management -> Sleep Settings
  • Specify the unattended sleep timeout (on battery) -> 0
  • Specify the unattended sleep timeout (plugged in) -> 0
  • Allow Applications to prevent Automatic sleep (on battery) -> Enabled
  • Allow Applications to prevent Automatic sleep (plugged in) -> Enabled

Creating a new Power Policy based on High Performance with a higher Sleep Timeout and Screen Lock.

Creating a new Policy

User Configuration/Administrative Templates/Control Panel/Personalization/

  • Enable screen saver - Enabled
  • Password protect the screen saver - Enabled
  • Screen saver timeout - Enabled, 900 seconds

Setting to enable unattended sleep timeout setting in registry:

  • HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7
  • Attribute Value 2
  • Increase Unattended Sleep Timeout to 900+

Given the OU with inheritance denied doesn't fix it means that it's either a registry setting, or a GPO setting which is not removed by removing the policy itself from the object.

Improve this question
1
  • Can you create a report from one of the computers by running the gpresult /h c:\report.html as administrator and see what you can find in there ?
    – Swisstone
    Commented Feb 11, 2021 at 17:58

2 Answers 2

Reset to default
0

Did you try checking the corresponding Event IDs ?

IDs were posted here: https://stackoverflow.com/questions/11385164/eventviewer-eventid-for-lock-and-unlock

maybe you get more information, what is happening exactly, by the eventlog entries.

(I am new here and can only "answer" and not "comment" - hope, this is ok)

you can also temporarily move one workstation in an OU in the AD, where no GPO is applied to check.

Improve this answer
1
  • Hi, thanks for the pointer on the logs, I'll check it out, the Computer and User are already in a OU with no GPO's are applied, which just makes it more problematic to troubleshooting.
    – Plasma
    Commented Feb 10, 2021 at 14:34
0

If you have mobile windows configured, you're likely pulling in policies that's causing the issue. We had a user that accidentally signed into Windows Mail and the machine was locking up regardless of settings.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .