• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2350
  • Last Modified:

Don't allow screensaver or background changes

We are a school.  Our XP stations have 2 logins, teacher or Student.  We want to disallow students from changing the background or screensavers (they do cute things like "start screensaver in 1 minute" or make strange messages for a screensaver).

I looked at the local policies and didn't see it.  Is there a way?

1 Solution
Pete LongTechnical ConsultantCommented:
Hi dougp23
Click Start , click Control Panel , click Performance and Maintenance , and then click Administrative Tools.

Double-click Local Security Policy .

In the left panel, double-click Local Policies to expand it.

Go to Security options. These are our recommendations for a good high security system.
Default user screensaver enabled

Default user screensaver password protection is enabled

Default user screensaver program

Default user screensaver timeout value

Start > Run gpedit.msc

User Configuration > Administrative Templates > Control Panel > Dispaly
Double click Screen Saver
The simplest way would be to deny access to the Display control panel and pre-set the screensaver so that students could not directly change the settings with either a local or group policy.  This is under User Configuration | Administrative  Templates | Control Panel and it's sub-setting Display.

Alternatively, and less recommended way, would be to set the permissions on the Reg keys to read only for the student account.  Logon as the student and startup regedt32 (if you have dissallowed access to regedt32, your'll have to re-grant it temporarily).  Change permissions on HKCU\Control Panel\Desktop.  You could try the whole key or just the SCRNSAVE.EXE, ScreenSaveTimeOut keys.  When done, disallow regedit utils.

Still I would recommend doing this with Group policy.  If you do not have an AD to do GPO's, you can set the Local Group Policy for 2 distinct groups.  You do this by making the settings with Start | Admistrative Tools | Local Group Policy.  Next deny access to the Administrators group (or user) to the G:\WINDOWS\system32\GroupPolicy folder.  Thus on boot and logon, that account cannot read the local policy and thus it doesn't get enforced for them.  You must specifically use the deny option.  Otherwise, neither the teacher or student will be able to make the changes.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now