{"id":141,"date":"2026-05-26T06:15:21","date_gmt":"2026-05-26T06:15:21","guid":{"rendered":"https:\/\/velanremoteitsupport.com\/blog\/?post_type=techtips&p=141"},"modified":"2026-05-26T06:20:04","modified_gmt":"2026-05-26T06:20:04","slug":"gpo-window-lock-screen-inactive","status":"publish","type":"techtips","link":"https:\/\/velanremoteitsupport.com\/blog\/techtips\/gpo-window-lock-screen-inactive\/","title":{"rendered":"How to Use\u00a0GPO to Lock Screen\u00a0After Inactivity on Windows"},"content":{"rendered":"\n

Automated screen locking on domain workstations and servers can be set up using Group Policy, enhancing information security. This guide explains the importance of locking computers when idle and provides step-by-step instructions for IT administrators on implementing the Interactive Logon Machine Inactivity Limit policy, password protection, screen saver timeout, and registry settings.<\/p>\n\n\n\n

Security Note<\/strong>
A screensaver with a password is an example of a session lock. It is one of the simplest and most effective controls you can enforce centrally via Group Policy (GPO) \u2014 requiring zero end-user action.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Our blog covers every method available, including the classic GPO screen saver timeout<\/strong> path, the newer Interactive Logon: Machine Inactivity Limit<\/strong> policy, and registry-based deployment for granular control.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Method 1: GPO Lock Screen via Screen Saver Settings (User Configuration)<\/strong><\/h2>\n\n\n\n

<\/p>\n\n\n\n

This is the most widely used approach. It configures the screen saver timeout and enforces password-on-resume through the Group Policy Management Console (gpmc.msc)<\/strong>.<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

Step-by-Step Process For Creating and Linking the GPO<\/strong><\/h3>\n\n\n\n

<\/p>\n\n\n\n

Open Group Policy Management Console<\/h4>\n\n\n\n

On your domain controller (or a machine with RSAT installed), press Win + R<\/code>, type gpmc.msc<\/code>, and press Enter. This opens the Group Policy Management Console.<\/p>\n\n\n\n

Create a New GPO Object<\/h4>\n\n\n\n

Right-click your domain root (or the specific Users OU<\/strong> you want to target) and select Create a GPO in this domain, and Link it here\u2026<\/strong> Name it something descriptive like LockScreenPolicy<\/code>.<\/p>\n\n\n\n

Navigate to the Personalization Policies<\/h4>\n\n\n\n

Right-click your new GPO and select Edit<\/strong>. In the Group Policy Management Editor, navigate to:<\/p>\n\n\n\n

Make changes to the policy. Go to User Configuration -> Policies -> Administrative Templates -> Control Panel -> Personalization and make changes.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Configure the Four Key Screen Saver Policies<\/h3>\n\n\n\n

In the Personalization node you will see several settings. Configure each as follows:<\/p>\n\n\n\n

Policy Setting<\/th>Value<\/th>Purpose<\/th><\/tr><\/thead>
Enable Screen Saver<\/strong><\/td>Enabled<\/td>Activates the screen saver feature \u2014 required for other settings to take effect<\/td><\/tr>
Screen Saver Timeout<\/strong><\/td>Enabled \u2192 e.g. 300<\/code> (5 min), 600<\/code> (10 min), 900<\/code> (15 min)<\/td>Sets the idle period in seconds before the screen saver starts and the session locks<\/td><\/tr>
Password Protect the Screen Saver<\/strong><\/td>Enabled<\/td>Forces the user to enter their domain password to return to the session<\/td><\/tr>
Force Specific Screen Saver<\/strong><\/td>Enabled \u2192 scrnsave.scr<\/code> (blank) or your chosen .scr file<\/td>Prevents users selecting a different screen saver; use a blank one for performance<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Apply and Force a Group Policy Update<\/h3>\n\n\n\n

Close the editor. The policy will propagate automatically at the next Group Policy refresh cycle (typically every 90 minutes). To apply immediately on a target machine, open an elevated Command Prompt and run:<\/p>\n\n\n\n

gpupdate \/force<\/strong>\n<\/code><\/pre>\n\n\n\n
After the update, screen saver and lock settings will be greyed out in the Windows interface \u2014 users will be unable to alter or disable the screen lock policy.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Result<\/strong>:
Domain workstations will now automatically lock after the configured idle period. The user must re-enter their domain password to resume their session \u2014 this is automatic session locking enforced via GPO.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Method 2: Interactive Logon \u2014 Machine Inactivity Limit (Computer Configuration)<\/h2>\n\n\n\n
Available from Windows Server 2012 \/ Windows 8<\/strong> onwards, the Interactive Logon: Machine Inactivity Limit<\/strong> policy is a dedicated computer-level security setting that locks the workstation independently of screen saver settings. This is generally considered the more robust approach for servers and shared machines.<\/p>\n\n\n\n
Policy Path
You may locate it in Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Double-click the policy and set a value in seconds<\/strong>. For example, enter 300to lock after 15 minutes of inactivity. The maximum allowed value is 599940<\/code> seconds.<\/p>\n\n\n\n
Registry Key for This Policy<\/h3>\n\n\n\n
This policy writes to the following registry location, which you can also deploy directly via GPO Preferences:<\/p>\n\n\n\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\n<\/strong>\nInactivityTimeoutSecs = 900   (REG_DWORD, value in seconds)<\/strong><\/code><\/pre>\n\n\n\n
Important<\/strong>TheInteractive Logon Machine Inactivity Limit<\/strong>applies at the computer<\/em> level, meaning it applies regardless of which user is logged in. It is particularly suited for servers, kiosks, and shared terminals where screen saver-based policies are less reliable.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Method 3: Deploy Lock Settings via Registry and GPO Preferences
<\/strong><\/h2>\n\n\n\n
For maximum control \u2014 especially when you need different policies for different groups \u2014 you can deploy the underlying registry values directly using Group Policy Preferences (GPP)<\/strong>. This gives you Item-Level Targeting capability (covered in the next section).<\/p>\n\n\n\n
Registry Keys (HKCU) for Screen Lock Policies<\/h3>\n\n\n\n
All values live under:<\/p>\n\n\n\n
HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop<\/strong><\/code><\/pre>\n\n\n\n
Registry Value Name<\/th>Type<\/th>Value<\/th>Effect<\/th><\/tr><\/thead>
ScreenSaveActive<\/code><\/td>REG_SZ<\/td>1<\/code> (enable) \/ 0<\/code> (disable)<\/td>Enables or disables the screen saver<\/td><\/tr>
ScreenSaveTimeOut<\/code><\/td>REG_SZ<\/td>300<\/code> (5 min), 900<\/code> (15 min), etc.<\/td>Idle time in seconds before screen saver activates<\/td><\/tr>
ScreenSaverIsSecure<\/code><\/td>REG_SZ<\/td>1<\/code> (password required) \/ 0<\/code> (no password)<\/td>Whether a password is required to unlock<\/td><\/tr>
SCRNSAVE.EXE<\/code><\/td>REG_SZ<\/td>scrnsave.scr<\/code><\/td>Forces a specific screen saver executable<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
To deploy these via GPP, navigate in the GPO editor to <\/p>\n\n\n\n
User Configuration \u2192 Preferences \u2192 Windows Settings \u2192 Registry<\/code> <\/strong><\/p>\n\n\n\n
and create each value as a Registry Item. Use Item-Level Targeting (see below) to control which users receive which values.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
Troubleshooting – If GPO Lock Screen Not Working<\/h3>\n\n\n\n
Policy not applying after gpupdate \/force<\/h4>\n\n\n\n