Windows 10 GPO / Registry - Interactive logon: Machine inactivity limit still using old 60 second lock out settings

Question

_{Friday, May 26, 2017 1:07 AM}

Set in GPO

Computer Config, Windows Settings, Security Settings, Local Policies, Security Options, Interactive logon: Machine inactivity limit.

Set 60 second timeout when testing, applied GPO, changed to 900 seconds updated GPO confirmed in machines local registry that 900 seconds picked up, rebooted but still locking screen after 60 seconds. Removed reg key re-applied GPO picked up the same key rebooted but still locking out after 60 seconds, rosp shows 900 seconds set.

Suggestions ?

Thanks

Stuart

All replies (12)

_{Monday, May 29, 2017 1:49 AM}

Hi stuart dyer,

Please check your screen saver setting.
Settings\Personalization\Lock Screen\Screen saver settings

Best regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Sunday, June 4, 2017 9:30 PM}

Hi,

Set to none

Thanks

Stuart

_{Sunday, June 4, 2017 9:57 PM}

we've never used that security setting to enforce inactivity lock/security

we've always used the secure-screen-saver stuff @ \User Configuration\Control Panel\Personalization\

I note from the settings reference workbook, that this setting you are choosing, doesn't seem to be implemented in the way you mentioned?

*Policy Path *
*> Computer Configuration\Windows Settings\Local Policies\Security Options *

*
Policy Name *
*> Interactive logon: Machine inactivity limit *

*
Supported On *
***> Windows 8, Windows Server 2012 ***

*
Registry Settings *
***> Not a registry key ***

*
Help Text *
> "Interactive logon: Machine inactivity limit.
Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session.
Default: not enforced.

*
Reboot Required*
> No

Don [doesn't work for MSFT, and they're probably glad about that ;]

_{Sunday, June 4, 2017 10:07 PM}

Thanks, hmmm, though it does create a registry key

_{Wednesday, August 23, 2017 11:23 PM}

Stuart did you ever find a solution for this issue?  I am experiencing the exact same trouble with this GPO setting on Windows 10 1607.  I have it set to 900 sec and occasionally employees will call in reporting that the machine is locking after a few minutes of inactivity.  We connect to the machine and look around.  Then disconnect and the employee says the issue is gone and the machine is back to normal 900 sec lock.  GPResult shows the setting to be applied and accurate.  We are not setting another screensaver lockout option.  I'm curious if you decided to go another route to lock these Windows 10 machines or if you found a solution.   Thanks for any info!  Daniel

_{Monday, August 28, 2017 12:40 AM}

Hi,

What i did to resolve this was set a screen saver with 1 minute timeout with password, let it go to the screen saver, and then logged back in and remove the screen saver.

Thanks

Stuart

_{Monday, August 28, 2017 9:43 PM}

Thanks, hmmm, though it does create a registry key

Yes, it's a quirky thing, security policy. It *is* a registry key, but the population and management/reassertion of the regkey is driven by the security database (secedit.sdb), so the regkey gets overwritten from content in secedit.sdb on a cycle driven by the security policy engine. It's old-school, in a way, because it uses INF files, not POL files

Don [doesn't work for MSFT, and they're probably glad about that ;]

_{Wednesday, March 28, 2018 2:26 PM}

We're setting this to 900 seconds (same as inactivity time) via GPO and we're still having this issue. It's random, too. Sometimes my computer will remain unlocked for hours and hours (I don't lock it when I'm working from home) and sometimes it's less than 5 minutes.

_{Friday, April 20, 2018 3:44 PM}

Hey @WBrady1965 did you ever find a resolution to this?

We just started implementing this policy with a 90 minute timeout earlier this week.

In the past few days we've heard and witnessed some users with extremely short logout times (some less than a minute). We are playing around with some this morning and it looks like all the affected folks have a Custom Power plan set. We do not manage power settings in any way. Once we flip them to Balanced and reset to defaults this issue appears to go away.

It has only been a few hours. I'll try and remember to follow up here if it looks like this resolves the issue.

EDIT Computer 1: Resetting the power plan to defaults fixed one unit.

**EDIT Computer 2: **The second computer, upon investigation, had several different hardware and software problems so ultimately we reimaged it but it should be noted that adding the hidden power setting "System unattended sleep timeout"

https://www.sevenforums.com/tutorials/246364-power-options-add-system-unattended-sleep-timeout.html

did not resolve the 59 second screen lock on this computer.

EDIT Computer 3: Yesterday afternoon one of my help desk guys had a call from a third user. He found another power setting that is available after editing a registry key. "Console lock display off timeout".

https://www.onmsft.com/news/adjust-windows-10-lock-screen-timeout

Modifying this value after enabling the option appears to have resolved the issue for this third user, but it did require a restart.

_{Tuesday, April 24, 2018 1:04 PM}

I have not found a resolution. This is still happening. I will check into the power plans and see - I believe we are doing a custom power plan but I will have to check with the engineer who set that part of the GPO. It would be nice if that's all that it is - thanks for the tip!

WB

_{Tuesday, April 24, 2018 1:21 PM}

Be sure to see my edits to the comment above! :)

I made the last one just a few moments ago.

_{Tuesday, April 24, 2018 2:07 PM}

So, as a separate issue, if you lock your screen, the displays go dark after a minute. That's what the onmsft link seems to be for but... that being said, after some thought it may fix the other issue as well. I know our VMware engineer did this manually to his machine so I'm going to check with him and see if he has any issues with it locking at random times. If he doesn't, then I'll just need to figure out how to deploy it. The first reg key is easy enough to do via GPP but I'll have to find out where it stores the values for the time so I can set the time myself.

Thanks!

WB