No announcement yet.

GPO Screen saver lock-

  • Filter
  • Time
  • Show
Clear All
new posts

  • GPO Screen saver lock-

    I have searched the forums and couldn't find this-

    I have a couple of GPO's that were created in a windows 2000 domain. The domain was upgraded before I started working for the company. We have a 2003 terminal server farm with a few servers in it. I want the servers to lock after 5 min of inactivity- Here is what I have done thus far.
    1- Created a GPO in the OU that servers reside in
    2- In computer config --> Admin Temp--> system --> group policy --enabled group policy loopback - (replace)

    3- under user config --> admin temp--> control panel--> display -
    enable -remove display
    enable - prevent changing wall paper
    enable - hide screen saver
    enable - screen saver
    enable - screen saver exec name (scrsave.scr)
    enable - password protect the screen saver
    enable - screen saver time (300)

    When I do a gpresult the policy is being applied but (alot more stuff in the policy is working) it is not locking the system after 5 minutes of idle time.

    I have also verified the ADM's are 2003 server adms.

    Can anyone think of any reason this is not being applied to the systems???????

  • #2
    Re: GPO Screen saver lock-

    Two things I can think of:

    1. Have the users logged out and back in? User settings get applied at logon.
    2. Do the users have permission to the path where scrsave.scr file is?


    • #3
      Re: GPO Screen saver lock-

      I have one test terminal server in the OU that I am using for testing-

      Yes users on the computer have rights to the .scr file-
      And I have done a gpupdate /force and logged my test user on and off-

      When I do a gpresult from the GPO management console the policy is being applied and it looks like the setting are applied-

      Here is the print out from a GP Result from the management console- Terminal Services is the GPO

      Administrative Templateshide
      Control Panelhide
      PolicySettingWinning GPOProhibit access to the Control PanelEnabledTerminal services

      Control Panel/Displayhide
      PolicySettingWinning GPOHide Appearance and Themes tabEnabledTerminal servicesHide Screen Saver tabEnabledTerminal servicesPassword protect the screen saverEnabledTerminal servicesPrevent changing wallpaperEnabledTerminal servicesRemove Display in Control PanelEnabledTerminal servicesScreen SaverEnabledTerminal servicesScreen Saver executable nameEnabledTerminal servicesScreen Saver executable namescrnsave.scrPolicySettingWinning GPOScreen Saver timeoutEnabledTerminal servicesNumber of seconds to wait to enable the Screen SaverSeconds:300

      Control Panel/Display/Desktop Themeshide
      PolicySettingWinning GPOLoad a specific visual style file or force Windows ClassicEnabledTerminal services


      • #4
        Re: GPO Screen saver lock-

        Have you defined the path to the screeensaver?
        If not, than the screensaver should reside under %Systemroot%\System32
        Set-Location Malibu Beach



        • #5
          Re: GPO Screen saver lock-

          scrnsave.scr resides in the C:\windows\system32 directory = %systemroot%\system32- I shouldn't have to put the path in should I?


          • #6
            Re: GPO Screen saver lock-

            Ok I discovered something interesting-
            1- remember these are 2003 terminal servers
            2- when I applied the policy to the domain admins - the policy works

            This means that the issue is domain users don't have the necessary rights to make the changes they need- does anyone have any ideas please????/