I run a network of computers and I would like enforce a GPO which locks the screen after a predefined idle time. I can't find this setting, I can only find a screen saver idle time setting, how can I get a log-out screen accomplished?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Actually I found (and tested) in Windows Server 2012 R2, under:
Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options>
And open item
Interactive logon: Machine inactivity limit
Interactive logon: Machine inactivity limit.
Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.
Default: not enforced.
Well, through Group Policy you can force to lock down a workstation via a password protected screensaver, but not to log it off. The GPO settings for locking down a workstation via screensaver can be found at: Administrative templates\control panel\display\password protect the screen saver and screen saver timeout.
The more direct solution you are likely looking for is located in:
Group Policy Management / Group Policy Editor
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
Microsoft Network Server: Amount of idle time required before suspending session.
For Windows XP, Vista and 7, you only can locked the workstation with the User Configuration > Policies > Administrative Templates > Control Panel > Personalization feature. This GPO feature already apply to the newer operating systems, but some Windows 8.1 and 10 versions are having issues with it. So, for those Windows versions I'd take advantage of the Interactive logon option.
You should be careful when applying both, Screensaver with password and Interactive logon: Machine inactivity limit, as they may come in conflict and lead to unexpected results for Windows 8 and later versions.
Interactive logon: Machine inactivity limit gpo feature only apply to Windows 8 and later versions.
But all depends of your environment and the Windows versions you have deployed in your domain.
In my french version of W2K8, I have in :
GPO > Strategy > Administration Model > System > Power Management > Screensaver options > Ask for a password when computer wake up
It should do the trick...
PS : the translation of GPO entries is approximative
To force a lock enforce the screen saver with the "require a password..." option. Logging out is a whole different thing. Which are you after?
On Windows Server 2008 these settings can be found in: User Configuration > Policies > Administrative Templates > Control Panel > Personalization
Create a new GPO then edit it and go to: Computer Config>Policies>Windows Settings>Security Settings>Local Policies>Security Options and find
Interactive logon: Machine inactivity limit. Set that to whatever time you want and it will lock the PC after it hits that timer.
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?