6

Is there a GPO option to disable the idle-time screensaver for RDP connections, but keep the idle-time screensaver options for interactive logins?

Edit: All users are TS users as well a local so they are in the same OU. We need the screensaver 'disabled' when they RDP.

  • Are they using RDP against a different computer (like a terminal server), or are you talking about RDP'ing into the same computer as they log on locally? – pauska Mar 27 '12 at 23:03
  • In this instance I'm talking about users logging in to their usual workstation via RDP, however they are also TS users. – Matthew Halliday Mar 27 '12 at 23:37
  • Do (or can you make) the users log off locally before logging on RDP? This is a critical point in the solution that I have in the back of my head, but the answer is going to take at least 15 minutes to write.. – pauska Mar 28 '12 at 0:04
  • Struggling to find a WMI filter for RDP sessions but if there is one that could well help to apply the policy only if they are a local connection perhaps – Tim Alexander Oct 8 '14 at 12:04
1

So as @ELT comments, you need to put in place a loopback policy, so full set up would be:

  • Create a GPO on the OU of the server.
  • Set the "Enable screen saver" policy at the user configuration branch to "Disabled".
  • At the Computer Configuration branch, set "Configure user Group Policy loopback processing mode" to "Enabled", mode "Merge".

This last policy will force to calculate the settings of this GPO as if the user belongs to the OU where the server is. Therefore, will take "Enable screen saver: Disabled".

|improve this answer|||||
1

Some months ago I published my solution to this problem here. As a reaction on the post of tfrederick74656 (below) I stated to have a better solution using the Item-level targeting for the Remote desktop.

After I posted this, it worked for one or two days and then did nothing anymore. After some months of doing other things and wondering what really happens I started all over again. And this time I really have the solution to the problem!

Goal: All laptops, desktops and servers with lock screen policy, except RDP's.

It is not an item-level-targeting solution anymore, but a script and one setting together in a GPO. As told on other places there are four settings that you will need:

  • Enable screen saver

  • Enabled Password protect the screen saver

  • Enabled Force specific screen saver

  • Enabled ScreenSaveTimeOut [time in seconds]

Because I don’t know what setting is responsible for this thing to work, I wanted to get them all in the script. One setting I couldn’t find, so this one is separated from the others: Force specific screensaver. (You don’t have to tell the system what screensaver you will need.) The other thing we need is a script: LockDesktopAfter3MinutesExceptRDP.PS1

Here’s the GPO: User configuration - Policies - Administrative Templates - Control Panel - Personalization - Force specific screensaver: Enabled (You don’t have to tell the system what screensaver you will need.)

Group Policy

And here’s the script that I added into the GPO:

$File = "c:\temp\sessions.txt"
query session > $File
$text = Get-Content $File
ForEach ($Line in $text)
{
If ($Line -like '*>console*')
    {
    #console session
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaveActive -Value 1
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaverIsSecure -Value 1
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaveTimeOut -Value 180
    }
ElseIf ($Line -like '*>rdp-tcp*')
    {
    #RDP session
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaveActive -Value 0
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaverIsSecure -Value 0
    Set-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop\" -Name ScreenSaveTimeOut -Value 86400
    }
}
# Apply this new policy now (immediately after this registry change)
Start-Sleep -s 10
Start-Process -FilePath "rundll32.exe" -ArgumentList "user32.dll, UpdatePerUserSystemParameters 1, True"

And this is what the script is about:

When you type ‘query session’ in a cmd box, you will get your session and possible other sessions in a few lines. Your own session has a ‘greater-than sign’ at the start of the line.

The powershell script reads this output line by line and checks if ‘>console’ or ‘>rdp-tcp’ is present. Now you know if you are dealing with a remote desktop –desktop or a console-desktop. You can now change the lock-desktop behavior depending on the situation by changing the registry items.

But this is only half of the solution.

The real problem was that you have to tell the system that you want the result NOW. This is done by running the last line of the script.

I hope this will help you out.

|improve this answer|||||
  • Welcome to Serverfault! Your picture "Registry setting" doesn't show the whole path in the registry and would be better as text. The second picture could also be edited as text or you could use ![ to make it show embedded to the text. Thanks for the answer! Just take some time to improve your formatting. – Esa Jokinen May 3 '17 at 12:43
0

I would put the TS users in a separate OU per this Microsoft's technet article.

Change this PO in the Group Policy snap-in under:

enter image description here

|improve this answer|||||
  • Not applicable as per question as we do not talk of separate users here. – TomTom Jun 2 '14 at 9:03
  • "all users are TS users" assumes more than one user? – Fergus Jun 3 '14 at 1:56
  • Yes, but it does not mean "there are TS and there are other users". Which means you can not isolate them into an OU or any other form. You misrepresent the quote because the full sentence is: "All users are TS users as well a local so they are in the same OU". – TomTom Jun 3 '14 at 5:08
  • ok... my point is; put the users into a separate OU while using RDP - similar to an administrator account as proposed here: tinyurl.com/ogst5vd . Otherwise how would you distinguish between those that need their idle-time screensaver set (remote) or those that are local? – Fergus Jun 3 '14 at 16:36
  • 1
    That is exactly the problem. I would assume the situation is that people use TFS sometimes remotely and sometimes not ;) And then you DO have this problem. – TomTom Jun 3 '14 at 16:42
0

I know this is an old question, and this is a bit hackish of an answer, but you could simply make a Group Policy Preferences Registry item to disable the screensaver when the session name contains RDP. You could set up the registry item to set the timeout to something ridiculous like 9999 minutes:

Screen Saver Timeout Registry Item

Then set up the targeting to only apply when the session name matches an RDP session. There's no wildcard, but the number is incremented at each RDP logon, resetting at reboots, so just put in a bunch.

Targeting Editor

Not exactly an elegant solution, but it would get the job done. Make sure you create this as a user policy, and check the "run in current user context" box.

|improve this answer|||||
0

Never done it with screensavers but have implemented a similar type of policy with printers.

GPO that targets just the specific OU with the Terminal Servers -note* we are targeting computer objects. Use loopback policy to enforce the screensaver settings on users; if configured correctly, it should apply to all users at logon.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.