Solved

Screensaver timeout GPO no longer works on Windows 10

Posted on 2016-09-08
16
40 Views
Last Modified: 2016-09-17
The location is a school with computer labs. The workstations login as general student accounts so they stay logged in all day as the same account. Teachers do not want computers going to a lock screen forcing them to have students log back in during the day between classes.
Prior to Windows 10, this GPO worked great. Windows 10 appears to be ignoring the screensaver settings. I have not been able to locate a technical article that shows where the settings are in group policy that Windows 10 will actually apply that controls the screensaver timeout or lock screen timeout.

You can see all the details of the GPO in the attached document.

The GPO settings worked extremely well before the machines were upgraded to Windows 10. Now the screen saver and screen lock time settings are being completely ignored.
H--QPC-Clients-KCLS-ScreenSaverLock.pdf
0
Comment
Question by:Felicia King
  • 9
  • 5
  • 2
16 Comments
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
We see no such behavior here. So how does it behave? What does it do after what time on battery/plugged?
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
The screen goes to the lock screen after about 15 - 20 minutes. When the student comes back to the PC, they have to move the mouse and then put in the password for the account that is already logged in. So they are effectively unlocking the screen.
I think the issue here is that the screensaver timeout settings in GPO for older OS do not seem to affect the lock screen settings in Windows 10, and I don't see where the Windows 10 lock screen settings exist in GPO.

I do have all the Windows 10 GPOs installed and I'm using GPO Central Store to ensure that all the Admin Templates and settings are available.
0
 
LVL 47

Expert Comment

by:dstewartjr
Comment Utility
Go over the settings here

https://technet.microsoft.com/en-us/itpro/windows/manage/windows-spotlight

User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
When I go into the GPO, I can see other things related to Windows 10, so I know that the Win10 Admin templates are loaded, however, there is no Cloud Content section shown in the GPO. The machines are all Win10 Pro. I will check another AD environment to see if that Admin Template path to Cloud Content shows there.
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
I just checked gpedit.msc on a Windows 10 Pro machine as well as another AD environment (gpmc.msc) and Cloud Content is not a valid path in group policy as listed.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Which version of 10, 10240 still?
0
 
LVL 47

Expert Comment

by:dstewartjr
Comment Utility
You need to install the latest ADMX files

https://www.microsoft.com/en-us/download/details.aspx?id=53430
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
The only thing different in 10 as compared to win7 in this respect is that if the screen is turned off as the power settings enforce, the session will also be locked. There are no new policies and I never had to configure spotlight.

I would use gpresult to verify what got applied and also check the corresponding registry values.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 4

Author Comment

by:Felicia King
Comment Utility
Installed Admx and Adml bundle into GPO Central Store per the pack from 8/5/2016.
https://www.microsoft.com/en-us/download/details.aspx?id=53430
Cloud Content is now a configurable option, but as McKnife indicates, there really are no settings in there that impact the screen timeout to lock option.
I had previously looked into the GP Results, but will do so again now that the new ADMX and ADML are in place.
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
Using both gpresult /H C:\Temp\GPResult.htm and rsop.msc both as the student account and as local admin indicates that GPO is processing properly. Also reviewing the settings on the workstation while logged in as the student account indicates that the screensaver timeout setting is coming through from GPO correctly. It shows screensaver timeout 480 minutes. We are going to gather more data from the teachers fresh in the morning to find out if the lock screen is still coming up instead of the desktop session staying logged in and unlocked.
0
 
LVL 4

Accepted Solution

by:
Felicia King earned 0 total points
Comment Utility
I found that group policy was not processing properly in all the scenarios on the lab machines due to a GPO processing error from an Internet Explorer settings management policy. I unlinked that policy and then the screensaver timeout settings came across to all the machines reliably.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
My suggestion was "I would use gpresult to verify what got applied" which had indeed "to do" with the solution. But nevermind, main thing is that it works :-)
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
I did not use GPResult. GPResult showed no errors. It showed that they were applied. Only using RSOP.msc exposed the problem.
GPResult /R did not expose the problem.
GPresult /H C:\Temp\GPResult.htm did not expose the problem.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Really? Astounding, since gpresult starts an rsop session as well. Sure that you did not overlook it?
0
 
LVL 4

Author Comment

by:Felicia King
Comment Utility
GPResult did not produce errors. It was only RSOP.msc running once as local admin and then once as the student account that generated the error that identified the cause of the GPO processing failure. Even GPResult /H C:\Temp\GPResult.htm showed no errors in the HTM output. In fact, it stated that all the GPOs were processed and it showed that the settings had applied from the desired GPOs with the desired GPO being the winning GPO for the settings.
0
 
LVL 4

Author Closing Comment

by:Felicia King
Comment Utility
Solution to the problem was found and it had nothing to do with any of the previous suggestions from other parties.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

When it comes to showing a 404 error page to your visitors, you do not want that generic page to show, and you especially do not want your hosting provider’s ad error page to show either. In this article, I will show you how to enable the custom 40…
My experience with Windows 10 over a one year period and suggestions for smooth operation
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now