I run a network of computers and I would like enforce a GPO which locks the screen after a predefined idle time. I can't find this setting, I can only find a screen saver idle time setting, how can I get a log-out screen accomplished?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Actually I found (and tested) in Windows Server 2012 R2, under:
Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options>
And open item
Interactive logon: Machine inactivity limit
Interactive logon: Machine inactivity limit.
Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.
Default: not enforced.
Well, through Group Policy you can force to lock down a workstation via a password protected screensaver, but not to log it off. The GPO settings for locking down a workstation via screensaver can be found at: Administrative templates\control panel\display\password protect the screen saver and screen saver timeout.
The more direct solution you are likely looking for is located in:
Group Policy Management / Group Policy Editor
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
Microsoft Network Server: Amount of idle time required before suspending session.
For Windows XP, Vista and 7, you only can locked the workstation with the User Configuration > Policies > Administrative Templates > Control Panel > Personalization feature. This GPO feature already apply to the newer operating systems, but some Windows 8.1 and 10 versions are having issues with it. So, for those Windows versions I'd take advantage of the Interactive logon option.
You should be careful when applying both, Screensaver with password and Interactive logon: Machine inactivity limit, as they may come in conflict and lead to unexpected results for Windows 8 and later versions.
Interactive logon: Machine inactivity limit gpo feature only apply to Windows 8 and later versions.
But all depends of your environment and the Windows versions you have deployed in your domain.