[cid:[email protected]]
Here’s what the Center for Information Security Benchmark for Windows 7 suggests. --Jeff -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Michael Leone Sent: Wednesday, September 6, 2017 11:03 AM To: [email protected] Subject: Re: [NTSysADM] Group Policy - Enforce screensaver and password On Wed, Sep 6, 2017 at 11:38 AM, Wolf, Daniel <[email protected]<mailto:[email protected]>> wrote: > Don't specify a screensaver. It will just lock the machine with the screen > off. OK. So what if the user doesn't choose a screensaver. Then nothing happens, right? No screensaver, and - more importantly - no password needed to unlock the PC (presuming the display turns off, for power saving). I got the impression that this is what he is trying to prevent. Doesn't want people just walking away from a PC, and leaving it unlocked, for anyone to walk up and do nefarious things ... > > -----Original Message----- > From: [email protected]<mailto:[email protected]> > [mailto:[email protected]] On Behalf Of Michael Leone > Sent: Wednesday, September 6, 2017 10:26 AM > To: [email protected]<mailto:[email protected]> > Subject: [NTSysADM] Group Policy - Enforce screensaver and password > > I've had a "suggestion" from my CIO. :-) He would like to use GP to enforce > that all domain computers have a screensaver (set to like 15 minutes), and > that the screensaver is password enabled. He didn't seem to care which > screensaver, as long as one is set. > > (these are all Win 7 PCs, BTW) > > I see the options in User Config/Policies/Admin Templates/Control > Panel/Personalization that I can Enable Screen saver and password protect the > screen saver. But if I read it right, I either have to specify which screen > saver to use, or depend on the user to pick one. > > So what happens if I choose > > Enable screen saver: ENABLED > Password protect the screen saver: ENABLED screen saver timeout: 900 > seconds > > and the user does *not* set a screensaver? If I use the above settings, do I > really also need to force a specific screen saver, so that I can be sure that > at least a passworded screen saver is set? > > What do the rest of you do? I'm assuming at least some of you enforce > passworded screensavers. > > Thanks for any advice. > >
