Screen Lock and Sleep¶
A machine left logged in and unattended is a machine anyone can use. The screen should lock after a short idle time and require a password to unlock.
Where it is¶
Three places set this; policy is the one that applies to every user.
Group Policy (recommended)¶
gpedit.msc → User Configuration → Administrative Templates → Control Panel → Personalization:
| Setting | Value |
|---|---|
| Enable screen saver | Enabled |
| Password protect the screen saver | Enabled |
| Screen saver timeout | Enabled, 600 seconds (10 minutes) |
| Force specific screen saver | Enabled, scrnsave.scr (the blank one) |
Security Options¶
secpol.msc → Local Policies → Security Options → Interactive logon: Machine inactivity limit: 900 seconds. This locks the machine regardless of screen saver settings.
Settings (per user)¶
Settings → Personalization → Lock screen → Screen saver → tick On resume, display logon screen, wait 10 minutes.
Waking from sleep¶
A machine that wakes without asking for a password is a machine anyone can use. gpedit.msc → Computer Configuration → Administrative Templates → System → Power Management → Sleep Settings:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.35.6.5 | Require a password when a computer wakes (on battery) | Enabled | |
| 18.9.35.6.6 | Require a password when a computer wakes (plugged in) | Enabled | |
| 18.9.35.6.1 | Allow network connectivity during connected-standby (on battery) | Disabled | A sleeping machine stays off the network |
| 18.9.35.6.2 | Allow network connectivity during connected-standby (plugged in) | Disabled | |
| 18.9.35.6.3 | Allow standby states (S1-S3) when sleeping (on battery) | Disabled | BitLocker. See Device and Memory Protection. |
| 18.9.35.6.4 | Allow standby states (S1-S3) when sleeping (plugged in) | Disabled | BitLocker. |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" /v DCSettingIndex /t REG_DWORD /d 1 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 |
DCSettingIndex |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 |
ACSettingIndex |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 |
DCSettingIndex |
REG_DWORD | 0 |
HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9 |
ACSettingIndex |
REG_DWORD | 0 |
Verify¶
For the current user:
reg query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure
reg query "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut
ScreenSaverIsSecure 1 and a timeout of 600 or less.
For the policy:
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop"
Shows the same values when set by policy.
Try it¶
- Set the inactivity limit to 60 seconds and wait. Then set it back to 900.
- Set the screen saver values for a test user and find them under
HKCU.
Build it¶
Add the machine inactivity limit to protections.bat. The HKCU screen saver values need a per-user script; write one that takes a username and loads that user's hive.