none
Windows 2008 R2 Screen Lock Issue (GPO)

    Question

  • Scenario: We will be deploying POS machines at our stores that will have Windows 2008 R2 as the preferred OS. The function of this POS machine is for POS administration and not for ringing up sales. The machines have been configured to autologin a specific user via GPO for POS functions. Also, a specific POS desktop environment shell has been configured to launch instead of Explorer (explorer.exe) shell environment at autologon.

    Everything seems to be working as expected except for the session of the user locking. Since the POS environment needs to be up at all times with the specific user profile, we do not want the OS to lock the user session. I've timed it and it seems to lock the screen (not log off) at approximately 15 minutes of inactivity, we do not want this.

    So far, these are the GPOs I have configured that have not fixed the issue:

    Computer Configuration>Policies>Windows Settings>Security Settings>Local Policies>Security Options>Microsoft Network Server: Amount of idle time required before suspending session = 99999 minutes
    Computer Configuration>Policies>Administrative Templates>System>Power Management>Sleep Settings>Allow applications to prevent automatic sleep (plugged in) = Enabled
    Computer Configuration>Policies>Administrative Templates>System>Power Management>Sleep Settings>Require a password when a computer wakes (plugged in) = Disabled
    Computer Configuration>Policies>Administrative Templates>System>Power Management>Sleep Settings>Turn off hybrid sleep (plugged in) = Enabled
    Computer Configuration>Policies>Administrative Templates>System>Power Management>Sleep Settings>Turn on the ability for applications to prevent sleep transitions (plugged in) = Enabled
    Computer Configuration>Policies>Administrative Templates>System>Power Management>Video and Display Settings>Turn off the display (plugged in) = Enabled = 99999 seconds
    User Configuration>Policies>Administrative Templates>Control Panel>Personalization>Enable screen saver = Disabled
    User Configuration>Policies>Administrative Templates>Control Panel>Personalization>Password protect the screen saver = Disabled
    User Configuration>Policies>Administrative Templates>System>Ctrl+Alt+Del Options>Remove Lock Computer = Enabled
    User Configuration>Preferences>Windows Settings>Registry>HKCU>Control Panel>Desktop>ScreenSaveActive = 0

    What are we doing wrong? How do I configure the OS to not lock the user session but keep it active at all times?

    As a side note: We have Windows 7 POS machines also that will be ringing up sales that we do not have the screen lock issue.

    Monday, December 29, 2014 2:27 PM

Answers

  • I finally got this figured out. It was a "no duh!" moment.

    I found that there was User Configuration in the Default Domain Policy someone else had configured that was enabling the screen saver after 15 minutes and it was applying to my OU.

    • Marked as answer by edwardcrosby Wednesday, January 07, 2015 5:52 PM
    Wednesday, January 07, 2015 5:52 PM

All replies

  • Hi,

    >>I've timed it and it seems to lock the screen (not log off) at approximately 15 minutes of inactivity, we do not want this.

    Based on your description, please check what power plan we are using, and please make sure Turn off the display of the power plan set to Never.

    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

    Best regards,

    Frank Shen


    Tuesday, December 30, 2014 5:12 AM
    Moderator
  • Please see my setting indicated in my original post. We have Turn Off the Display set to 99999 seconds. Per the policy description if it is set to disabled or not configured then users control the setting.
    Tuesday, December 30, 2014 7:30 PM
  • Hi,

    >>Please see my setting indicated in my original post. We have Turn Off the Display set to 99999 seconds.

    I understand that we have set the Turn Off the Display for this amount of time. However, just for double check, we can go to the power plan we are using to check if the setting has been applied successfully. If the setting has been applied successfully, it should be grayed out. Or, we can run command gpresult/h gpreport.html with admin privileges to collect group policy result report to check this.

    Besides, do we use other third party software to protect our computer? We can try to clean boot the server to see if the situation persists.

    Regarding how to perform a clean boot, the following article can be referred to for more information.

    How to perform a clean boot in Windows

    http://support.microsoft.com/KB/929135

    TechNet Subscriber Support
    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

    Best regards,
    Frank Shen

    Monday, January 05, 2015 2:25 AM
    Moderator
  • Yes, the setting has been applied. Currently looking at the Control Panel, Power Options the Turn Off the Display is greyed out with a setting of 27 hours and 46 minutes.
    Monday, January 05, 2015 2:13 PM
  • Also, keep in mind that it's not the Display that may not be causing this. It seems to be a Windows setting locking the user account.
    Monday, January 05, 2015 2:15 PM
  • I finally got this figured out. It was a "no duh!" moment.

    I found that there was User Configuration in the Default Domain Policy someone else had configured that was enabling the screen saver after 15 minutes and it was applying to my OU.

    • Marked as answer by edwardcrosby Wednesday, January 07, 2015 5:52 PM
    Wednesday, January 07, 2015 5:52 PM