Northridge IT Services

In this post we will see how to lock computers in domain via group policy. Most of the companies today want the computers to be locked out after specific interval of time or after specific duration of inactivity on the computer. The employees are advised to lock their computer before they step away from the computer but if the employee steps away without locking the computer it could lead to unauthorized access to domain workstations within your organization. With the help of group policy the administrator can define settings to automatically lock the computer after the specified amount of minutes. This will prevent the unauthorized access to the computer even though the employees forget to lock their computers.

Most of the companies have a branded screen saver that displays their company logo along with company information. In this post we will using one of the screen saver that comes with windows operating system.

In this post we will be using a screen saver so that after the inactivity timeout on the computer, the computer gets locked and a screen saver is displayed. When clicked on the screen saver, the computer should prompt the user to enter the credentials to login. Windows server 2008 R2 comes with few inbuilt screen savers, we will be using one of them. The screen savers can be found in \Windows\Winsxs\ and look for .scr files.

Once you have found the screen saver, copy the screen saver file to a shared folder. The clients would be displaying the screen saver from this path.

Open the Group Policy Management, right click on your domain and click on Create a GPO in this domain and link it here. Provide a name to the policy such as Screensaver Policy and click on OK.

Right click the Screen saver policy and click on Edit. The Group Policy Management Editor opens in a new window, expand User Configuration, expand Policies, expand Administrative Templates, expand Control Panel and click on Personalization. We will configure the policy settings now.

Double click on Screen saver timeout. This settings specifies the amount of time after which the screen saver must be launched. Click on Enabled to enable this policy setting, and set the time after which the screen saver should appear. In this example i will set the idle time to 60 seconds, which means if the computer is idle for 60 seconds the screen saver will be shown. Click on Apply and OK.

Double click the policy setting Force specific screen saver. This setting if enabled displays the screen saver specified in the policy setting. Click on Enabled, provide the path where the screen saver file is located. Click on Apply and OK.

Double click the setting Enable Screen saver, click on Enabled, this setting will enable the screen saver. Before you enable this setting you must specify the screen saver executable path and screen saver timeout must be configured.

Double click the setting Password protect the screen saver and click on Enabled. This setting will make all the screen savers password protected. If this policy is not configured, then the password protection cannot be set on any screen saver. For this setting to work correctly, make sure you have enabled the policy setting Enable screen saver and Screen saver timeout. Click on Apply and OK.