3

I setup all my machines to require a logon prompt after resuming from screensaver. However, randomly about once every week or two on one particular machine I find that suddenly no logon is required. When I check the settings, the On resume, display logon screen checkbox has become unchecked. Windows has kindly turned it off for me all on its own. This happens quite consistently and it's a huge security hole.

Yes, I know I can lock the machine every time I walk away, but I shouldn't have to do that. A simple but vital feature like this in Windows should be rock solid, and it is definitely not.

Has anyone seen this before? Any idea how to fix it? I would imagine that setting is a registry key, and I could easily write a small program to keep it set properly if I knew what registry key is used.

(Note: This is not a duplicate of this question since he didn't report the setting actually being turned off.)

6
  • Is it a workgroup or domain machine?
    – doenoe
    Feb 25, 2016 at 16:03
  • @doenoe Workgroup. Feb 25, 2016 at 16:10
  • Do you have any local policies set? \
    – doenoe
    Feb 26, 2016 at 8:15
  • @doenoe All just defaults. Feb 26, 2016 at 14:18
  • are you sure there are not any policies set? open gpedit.msc and check under User Configuration\Policies\Administrative Templates\ Control Panel/Personalization check for the Enable screen saver and Password protect the screen saver policy.
    – doenoe
    Feb 26, 2016 at 14:24

2 Answers 2

2

You can force it by Group Policy by setting:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaverIsSecure = 1

I just tested it on Windows 7 and it worked (the box is checked and grayed out, so I can't undo it via the Screen Saver Settings dialog).

Here are a few references:

http://support.microsoft.com/kb/815424 http://answers.microsoft.com/en-us/windows/forum/windows_7-desktop/on-resume-display-log-on-screen-check-box-grayed/7d33d714-1bf7-4668-b587-63c7690519ab

And another via the Group Policy editor:

http://social.technet.microsoft.com/Forums/windowsserver/en-US/18b1f210-e5fc-44ca-b160-139802c92faa/on-resume-password-protect-enable-with-group-policy

Note: I found it in User Configuration -> Administrative Templates -> Control Panel -> Personalization -> Password protect the screen saver (though I didn't test this method).

4
  • The user is able to enable the screen-saver lock, it just keeps turning off for some reason.
    – cutrightjm
    Aug 7, 2013 at 1:14
  • @ekaj I guess I should change the wording from "you can enable it" to "you can force it", as that registry change sets it at the Group Policy level, and won't let the end user change it from the Screen Saver dialog. I'll change the wording now. Aug 7, 2013 at 1:18
  • The registry key greys out the screen saver option, so hopefully that will suffice. If not, I can at least write a program or script to periodically reset that key. I'll give it a week or so to see if it works and then accept your answer if it does, so please don't think I'm ignoring your answer. Aug 7, 2013 at 1:36
  • Unfortunately, this didn't solve the problem. Even with no apps running that might disable a screen saver, I still found the session unlocked today after hours of non-use. The option to require a login prompt was still checked and greyed out, so that simply doesn't solve the problem. Aug 14, 2013 at 5:35
0

You might want to make sure that there is no malware at this computer. Run MBAM and SpyBot S&D on it, and check if there is something unusual going on.

If you have the WIndows CD, you could try booting the PC up from it, and selecting "Reapir Windows" (Or something similar). This should fix the issue.

2
  • Wouldn't malware that is already running continue to run in the background?
    – cutrightjm
    Aug 7, 2013 at 1:14
  • I am 100% certain malware is not the issue. Aug 7, 2013 at 1:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .