24

I run a network of computers and I would like enforce a GPO which locks the screen after a predefined idle time. I can't find this setting, I can only find a screen saver idle time setting, how can I get a log-out screen accomplished?

Thanks.

Improve this question
1
  • 3
    Total agreement with everybody else here-- you're mixing terminology. Do you want to lock the workstation or force the user to logoff? (If you did want forced logoff, which I'd highly recommend against, have a look at: support.microsoft.com/kb/314999)
    – Evan Anderson
    Oct 29, 2009 at 16:36

8 Answers 8

Reset to default
27

Actually I found (and tested) in Windows Server 2012 R2, under:

Computer Configuration>Policies>Windows Settings>Security Settings>Local
Policies>Security Options>

And open item Interactive logon: Machine inactivity limit

Explanation:

Interactive logon: Machine inactivity limit.

Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.

Default: not enforced.

enter image description here

Improve this answer
2
  • 1
    This works great for Windows 10 clients, but Windows 7 doesn't work with this. :/
    – XtraSimplicity
    Nov 9, 2017 at 2:35
  • compare the results of gpresult /h gpo.htm command result for each Windows version
    – Sam Doxy
    Jan 17, 2018 at 15:26
16

Well, through Group Policy you can force to lock down a workstation via a password protected screensaver, but not to log it off. The GPO settings for locking down a workstation via screensaver can be found at: Administrative templates\control panel\display\password protect the screen saver and screen saver timeout.

Improve this answer
3
  • To disable this setting through the registry, the path is HKCU:\software\policies\microsoft\windows\Control Panel\desktop
    – Nacht
    Oct 3, 2013 at 6:00
  • This setting don't exist in windows 2008. Which version are your using?
    – motobói
    Jul 18, 2014 at 16:22
  • 2
    On Windows Server 2008 or above they are: User Configuration > Policies > Administrative Templates > Control Panel > Personalization
    – CrazyTim
    Feb 25, 2015 at 4:16
4

The more direct solution you are likely looking for is located in:

Group Policy Management / Group Policy Editor

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

Microsoft Network Server: Amount of idle time required before suspending session.

Improve this answer
1
  • 7
    The description says that applies to SMB sessions
    – bradvido
    Apr 11, 2014 at 19:31
2

For Windows XP, Vista and 7, you only can locked the workstation with the User Configuration > Policies > Administrative Templates > Control Panel > Personalization feature. This GPO feature already apply to the newer operating systems, but some Windows 8.1 and 10 versions are having issues with it. So, for those Windows versions I'd take advantage of the Interactive logon option.

You should be careful when applying both, Screensaver with password and Interactive logon: Machine inactivity limit, as they may come in conflict and lead to unexpected results for Windows 8 and later versions.

Interactive logon: Machine inactivity limit gpo feature only apply to Windows 8 and later versions.

But all depends of your environment and the Windows versions you have deployed in your domain.

Improve this answer
1

In my french version of W2K8, I have in : 

GPO > Strategy > Administration Model > System > Power Management > Screensaver options > Ask for a password when computer wake up

It should do the trick...

PS : the translation of GPO entries is approximative

Improve this answer
0

To force a lock enforce the screen saver with the "require a password..." option. Logging out is a whole different thing. Which are you after?

Improve this answer
1
  • 1
    Agree that the question mixes terms - though I'll go so far as to recommend a lock vs. log-out or you're going to zap a lot of user work.
    – Kara Marfia
    Oct 29, 2009 at 12:32
0

On Windows Server 2008 these settings can be found in: User Configuration > Policies > Administrative Templates > Control Panel > Personalization

Improve this answer
0

Create a new GPO then edit it and go to: Computer Config>Policies>Windows Settings>Security Settings>Local Policies>Security Options and find Interactive logon: Machine inactivity limit. Set that to whatever time you want and it will lock the PC after it hits that timer.

Improve this answer
1
  • I dont see Interactive logon: Machine inactivity limit in the list? What version of SBS is this for?
    – Magic Mick
    Sep 29, 2015 at 10:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.