2

I have set up a lab with a number of Windows Server 2012 R2 machines. The lab has an Active Directory domain (DFL: Windows Server 2012 R2, FFL: Windows Server 2012 R2) and these machines are joined to the domain.

By default if left unattended these Windows machines will automatically lock. I do not want the machines to lock automatically. I do not have any security concerns with having the machines remain unlocked as this is an isolated lab.

I have created a group policy object that sets a number of configurations and the machines still lock. I have verified that the GPO has been applied to the machines.

The GPO configures the following settings:

  • Computer Configuration\Policies\Windows Settings\Local Policies/Security Options\Microsoft Network Server\Microsoft network server: Amount of idle time required before suspending session: 0 minutes
  • User Configuration\Policies\Administrative Templates\Control Panel/Personalization\Enable screen saver: Disabled
  • User Configuration\Policies\Administrative Templates\Control Panel/Personalization\Password protect the screen saver: Disabled
  • User Configuration\Policies\Administrative Templates\Control Panel/Personalization\Screen saer timeout: 0 seconds
  • User Configuration\Policies\Administrative Templates\System/Power Management\Prompt for password on resume from hibernate/suspend: Disabled

I've done a few hours of research and I've yet to find anything that has worked. Is there is another setting that controls this behavior?

Edit: output from gpresult /v:

C:\Windows\system32>gpresult /v

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
c 2013 Microsoft Corporation. All rights reserved.

Created on 9/24/2014 at 9:44:02 AM


RSOP data for CONTOSO\user01 on SERVER01 : Logging Mode
----------------------------------------------------------------

OS Configuration:            Member Server
OS Version:                  6.3.9600
Site Name:                   Default-First-Site-Name
Roaming Profile:             N/A
Local Profile:               C:\Users\user01
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
    CN=SERVER01,OU=SPSSearch,OU=Projects,DC=CONTOSO,DC=NET
    Last time Group Policy was applied: 9/24/2014 at 9:03:08 AM
    Group Policy was applied from:      DC01.CONTOSO.NET
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        CONTOSO
    Domain Type:                        Windows 2008 or later

    Applied Group Policy Objects
    -----------------------------
        Don't lock workstation
        Password Policy
        Default Domain Policy

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The computer is a part of the following security groups
    -------------------------------------------------------
        BUILTIN\Administrators
        Everyone
        BUILTIN\Users
        NT AUTHORITY\NETWORK
        NT AUTHORITY\Authenticated Users
        This Organization
        SERVER01$
        Domain Computers
        Authentication authority asserted identity
        System Mandatory Level

    Resultant Set Of Policies for Computer
    ---------------------------------------

        Software Installations
        ----------------------
            N/A

        Startup Scripts
        ---------------
            N/A

        Shutdown Scripts
        ----------------
            N/A

        Account Policies
        ----------------
            GPO: Password Policy
                Policy:            MaximumPasswordAge
                Computer Setting:  4294967295

            GPO: Password Policy
                Policy:            MinimumPasswordAge
                Computer Setting:  30

            GPO: Default Domain Policy
                Policy:            LockoutBadCount
                Computer Setting:  N/A

            GPO: Password Policy
                Policy:            PasswordHistorySize
                Computer Setting:  N/A

            GPO: Password Policy
                Policy:            MinimumPasswordLength
                Computer Setting:  N/A

        Audit Policy
        ------------
            N/A

        User Rights
        -----------
            N/A

        Security Options
        ----------------
            GPO: Password Policy
                Policy:            PasswordComplexity
                Computer Setting:  Not Enabled

            GPO: Default Domain Policy
                Policy:            ClearTextPassword
                Computer Setting:  Not Enabled

            GPO: Default Domain Policy
                Policy:            ForceLogoffWhenHourExpire
                Computer Setting:  Not Enabled

            GPO: Default Domain Policy
                Policy:            RequireLogonToChangePassword
                Computer Setting:  Not Enabled

            GPO: Default Domain Policy
                Policy:            LSAAnonymousNameLookup
                Computer Setting:  Not Enabled

            GPO: Don't lock workstation
                Policy:            @wsecedit.dll,-59042
                ValueName:         MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect
                Computer Setting:  -1

            GPO: Default Domain Policy
                Policy:            @wsecedit.dll,-59058
                ValueName:         MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash
                Computer Setting:  1

            N/A

        Event Log Settings
        ------------------
            N/A

        Restricted Groups
        -----------------
            N/A

        System Services
        ---------------
            N/A

        Registry Settings
        -----------------
            N/A

        File System Settings
        --------------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            N/A


USER SETTINGS
--------------
    CN=SharePoint Setup Account,OU=SPSSearch,OU=Projects,DC=CONTOSO,DC=NET
    Last time Group Policy was applied: 9/24/2014 at 9:03:39 AM
    Group Policy was applied from:      DC01.CONTOSO.NET
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        CONTOSO
    Domain Type:                        Windows 2008 or later

    Applied Group Policy Objects
    -----------------------------
        Don't lock workstation

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The user is a part of the following security groups
    ---------------------------------------------------
        Domain Users
        Everyone
        BUILTIN\Administrators
        BUILTIN\Users
        NT AUTHORITY\INTERACTIVE
        CONSOLE LOGON
        NT AUTHORITY\Authenticated Users
        This Organization
        LOCAL
        Authentication authority asserted identity
        High Mandatory Level

    The user has the following security privileges
    ----------------------------------------------

        Bypass traverse checking
        Manage auditing and security log
        Back up files and directories
        Restore files and directories
        Change the system time
        Shut down the system
        Force shutdown from a remote system
        Take ownership of files or other objects
        Debug programs
        Modify firmware environment values
        Profile system performance
        Profile single process
        Increase scheduling priority
        Load and unload device drivers
        Create a pagefile
        Adjust memory quotas for a process
        Remove computer from docking station
        Perform volume maintenance tasks
        Impersonate a client after authentication
        Create global objects
        Change the time zone
        Create symbolic links
        Increase a process working set

    Resultant Set Of Policies for User
    -----------------------------------

        Software Installations
        ----------------------
            N/A

        Logon Scripts
        -------------
            N/A

        Logoff Scripts
        --------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            GPO: Don't lock workstation
                Folder Id: Software\Policies\Microsoft\Windows\System\Power\PromptPasswordOnResume
                State:       disabled

            GPO: Don't lock workstation
                Folder Id: Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaverIsSecure
                Value:       48, 0, 0, 0
                State:       Enabled

            GPO: Don't lock workstation
                Folder Id: Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaveActive
                Value:       48, 0, 0, 0
                State:       Enabled

            GPO: Don't lock workstation
                Folder Id: Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaveTimeOut
                Value:       48, 0, 0, 0
                State:       Enabled

        Folder Redirection
        ------------------
            N/A

        Internet Explorer Browser User Interface
        ----------------------------------------
            N/A

        Internet Explorer Connection
        ----------------------------
            N/A

        Internet Explorer URLs
        ----------------------
            N/A

        Internet Explorer Security
        --------------------------
            N/A

        Internet Explorer Programs
        --------------------------
            N/A
  • What is the results of the gpresult on the system in question? – Rex Sep 24 '14 at 16:39
  • gpresult lists the GPO under Applied Group Policy Objects. I'll update the question with the (anonymized) dump of gpresult /v – shufler Sep 24 '14 at 16:42
  • 1
    Is someone logged into these machines when they become locked? If not, then it's doubtful that those user settings have anything to do with it. You might look at the Power Management settings under Computer Configuration in your GPO. – joeqwerty Sep 24 '14 at 16:44
  • @joeqwerty yes, a user is logged in. I am planning on running some network captures and want to keep the output on the screen as they run. The machines lock and I have to unlock again. – shufler Sep 24 '14 at 16:50
  • @joeqwerty I have also tried the Power Management approach. None of the options clearly stand out to me as being connected to automatically locking the workstation. Any suggestions? – shufler Sep 24 '14 at 17:01
6

On the suggestion of checking the Power Management settings by @joeqwerty I created a new Power Plan with the following settings:

  • Display -> Turn off display after -> On battery (minutes): 0
  • Display -> Turn off display after -> Plugged in (minutes): 0

I set this as the active power plan, and applied the GPO. After 25 minutes the machines are no longer automatically locking.

Here are the full steps for creating this:

  1. In Group Policy Management Editor, edit the target GPO
  2. Go to Computer Configuration\Preferences\Control Panel Settings\Power Options
  3. In the right pane, right click and select New -> Power Plan (At least Windows 7)
  4. In the Advanced settings tab, select the Create action
  5. Enter a new plan name (e.g. "Don't lock")
  6. Select Set as the active power plan
  7. Expand Display -> Turn off display after
  8. Change On battery (minutes) to 0
  9. Change Plugged in (minutes) to 0
  10. Click Apply, OK
  11. Apply the GPO to the target machine(s)
2

I modified the previous plan as the problem was with a KIOSK Locking, but I still wanted the power saving.

On the suggestion of checking the Power Management settings by @nucrash I created a new Power Plan with the following settings:

Additional Settings -> Require a Password -> On Battery: No
Additional Settings -> Require a Password -> Plugged in : No

I set this as the active power plan, and applied the GPO. The machines are no longer automatically locking.

Here are the full steps for creating this:

In Group Policy Management Editor, edit the target GPO
Go to Computer Configuration\Preferences\Control Panel Settings\Power Options
In the right pane, right click and select New -> Power Plan (At least Windows 7)
In the Advanced settings tab, select the Create action
Enter a new plan name (e.g. "Don't lock")
Select Set as the active power plan
Expand Additional Settings -> Require a Password on wakeup
Change On battery to No
Change Plugged in to No
Click Apply, OK
Apply the GPO to the target machine(s)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.