Screen Lock and Sleep¶
A machine left logged in and unattended is a machine anyone can use. The screen should lock after a short idle time and require a password to unlock.
Where it is¶
Three places set this; policy is the one that applies to every user.
Group Policy (recommended)¶
gpedit.msc → User Configuration → Administrative Templates → Control Panel → Personalization:
| Setting | Value |
|---|---|
| Enable screen saver | Enabled |
| Password protect the screen saver | Enabled |
| Screen saver timeout | Enabled, 600 seconds (10 minutes) |
| Force specific screen saver | Enabled, scrnsave.scr (the blank one) |
Security Options¶
secpol.msc → Local Policies → Security Options → Interactive logon: Machine inactivity limit: 900 seconds. This locks the machine regardless of screen saver settings.
Settings (per user)¶
Settings → Personalization → Lock screen → Screen saver → tick On resume, display logon screen, wait 10 minutes.
Waking from sleep¶
A machine that wakes without asking for a password is a machine anyone can use. gpedit.msc → Computer Configuration → Administrative Templates → System → Power Management → Sleep Settings:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.35.6.5 | Require a password when a computer wakes (on battery) | Enabled | |
| 18.9.35.6.6 | Require a password when a computer wakes (plugged in) | Enabled | |
| 18.9.35.6.1 | Allow network connectivity during connected-standby (on battery) | Disabled | A sleeping machine stays off the network |
| 18.9.35.6.2 | Allow network connectivity during connected-standby (plugged in) | Disabled | |
| 18.9.35.6.3 | Allow standby states (S1-S3) when sleeping (on battery) | Disabled | BitLocker. See Device and Memory Protection. |
| 18.9.35.6.4 | Allow standby states (S1-S3) when sleeping (plugged in) | Disabled | BitLocker. |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" /v DCSettingIndex /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" /v ACSettingIndex /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" /v DCSettingIndex /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" /v ACSettingIndex /t REG_DWORD /d 0 /f
Verify¶
For the current user:
reg query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure
reg query "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut
ScreenSaverIsSecure 1 and a timeout of 600 or less.
For the policy:
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop"
Shows the same values when set by policy.