Solved

Screensaver timeout GPO no longer works on Windows 10

Posted on 2016-09-08
16
126 Views
Last Modified: 2016-09-17
The location is a school with computer labs. The workstations login as general student accounts so they stay logged in all day as the same account. Teachers do not want computers going to a lock screen forcing them to have students log back in during the day between classes.
Prior to Windows 10, this GPO worked great. Windows 10 appears to be ignoring the screensaver settings. I have not been able to locate a technical article that shows where the settings are in group policy that Windows 10 will actually apply that controls the screensaver timeout or lock screen timeout.

You can see all the details of the GPO in the attached document.

The GPO settings worked extremely well before the machines were upgraded to Windows 10. Now the screen saver and screen lock time settings are being completely ignored.
H--QPC-Clients-KCLS-ScreenSaverLock.pdf
0
Comment
Question by:Felicia King
  • 9
  • 5
  • 2
16 Comments
 
LVL 54

Expert Comment

by:McKnife
ID: 41790125
We see no such behavior here. So how does it behave? What does it do after what time on battery/plugged?
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41790137
The screen goes to the lock screen after about 15 - 20 minutes. When the student comes back to the PC, they have to move the mouse and then put in the password for the account that is already logged in. So they are effectively unlocking the screen.
I think the issue here is that the screensaver timeout settings in GPO for older OS do not seem to affect the lock screen settings in Windows 10, and I don't see where the Windows 10 lock screen settings exist in GPO.

I do have all the Windows 10 GPOs installed and I'm using GPO Central Store to ensure that all the Admin Templates and settings are available.
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 41790169
Go over the settings here

https://technet.microsoft.com/en-us/itpro/windows/manage/windows-spotlight

User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 4

Author Comment

by:Felicia King
ID: 41790181
When I go into the GPO, I can see other things related to Windows 10, so I know that the Win10 Admin templates are loaded, however, there is no Cloud Content section shown in the GPO. The machines are all Win10 Pro. I will check another AD environment to see if that Admin Template path to Cloud Content shows there.
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41790192
I just checked gpedit.msc on a Windows 10 Pro machine as well as another AD environment (gpmc.msc) and Cloud Content is not a valid path in group policy as listed.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41790227
Which version of 10, 10240 still?
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 41790291
You need to install the latest ADMX files

https://www.microsoft.com/en-us/download/details.aspx?id=53430
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41790376
The only thing different in 10 as compared to win7 in this respect is that if the screen is turned off as the power settings enforce, the session will also be locked. There are no new policies and I never had to configure spotlight.

I would use gpresult to verify what got applied and also check the corresponding registry values.
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41790446
Installed Admx and Adml bundle into GPO Central Store per the pack from 8/5/2016.
https://www.microsoft.com/en-us/download/details.aspx?id=53430
Cloud Content is now a configurable option, but as McKnife indicates, there really are no settings in there that impact the screen timeout to lock option.
I had previously looked into the GP Results, but will do so again now that the new ADMX and ADML are in place.
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41790503
Using both gpresult /H C:\Temp\GPResult.htm and rsop.msc both as the student account and as local admin indicates that GPO is processing properly. Also reviewing the settings on the workstation while logged in as the student account indicates that the screensaver timeout setting is coming through from GPO correctly. It shows screensaver timeout 480 minutes. We are going to gather more data from the teachers fresh in the morning to find out if the lock screen is still coming up instead of the desktop session staying logged in and unlocked.
0
 
LVL 4

Accepted Solution

by:
Felicia King earned 0 total points
ID: 41794577
I found that group policy was not processing properly in all the scenarios on the lab machines due to a GPO processing error from an Internet Explorer settings management policy. I unlinked that policy and then the screensaver timeout settings came across to all the machines reliably.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41794584
My suggestion was "I would use gpresult to verify what got applied" which had indeed "to do" with the solution. But nevermind, main thing is that it works :-)
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41794592
I did not use GPResult. GPResult showed no errors. It showed that they were applied. Only using RSOP.msc exposed the problem.
GPResult /R did not expose the problem.
GPresult /H C:\Temp\GPResult.htm did not expose the problem.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41794599
Really? Astounding, since gpresult starts an rsop session as well. Sure that you did not overlook it?
0
 
LVL 4

Author Comment

by:Felicia King
ID: 41796734
GPResult did not produce errors. It was only RSOP.msc running once as local admin and then once as the student account that generated the error that identified the cause of the GPO processing failure. Even GPResult /H C:\Temp\GPResult.htm showed no errors in the HTM output. In fact, it stated that all the GPOs were processed and it showed that the settings had applied from the desired GPOs with the desired GPO being the winning GPO for the settings.
0
 
LVL 4

Author Closing Comment

by:Felicia King
ID: 41802910
Solution to the problem was found and it had nothing to do with any of the previous suggestions from other parties.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html) provided 218 attendees with a step-by-step guide for identifying Acti…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now