{"id":68483,"date":"2005-11-21T13:47:00","date_gmt":"2005-11-21T13:47:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/11\/21\/how-can-i-lock-a-workstation-after-five-minutes-of-inactivity\/"},"modified":"2005-11-21T13:47:00","modified_gmt":"2005-11-21T13:47:00","slug":"how-can-i-lock-a-workstation-after-five-minutes-of-inactivity","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-lock-a-workstation-after-five-minutes-of-inactivity\/","title":{"rendered":"How Can I Lock a Workstation After Five Minutes of Inactivity?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I lock a workstation after five minutes of inactivity, something recommended to us by our auditors?

— NM<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, NM. To tell you the truth, we don\u2019t know. Locking a computer remotely can be a bit of a problem; for more information on that, take a look at one of our columns<\/B><\/A> from a year ago. On top of that, you face the problem of deciding whether or not a computer is idle. Because you can\u2019t monitor for keystrokes or mouse clicks, about the best you can do is check the CPU usage and make a guess as to whether the computer is idle. That might work, but you\u2019d have to constantly monitor the computer and continually make a determination as to whether the machine is idle or not. There has to be a better way.<\/P>\n

And there is. After all, the computer can already monitor and lock itself after 5 minutes of inactivity: all you have to do is password-protect the screensaver and set the screensaver timeout value to 5 minuets. If the computer sits idle for 5 minutes the screensaver will kick in and the computer will be locked, which sounds like the very thing recommended by your auditors.<\/P>\n

Best of all, you can use scripts that directly modify the registry in order to configure the appropriate screensaver settings on all your computers. For example, here\u2019s a script that enables password-protection on the screensaver:<\/P>

HKEY_CURRENT_USER = &H80000001<\/p>\n
strComputer = “.”<\/p>\n
Set objReg = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\default:StdRegProv”)<\/p>\n
strKeyPath = “Control Panel\\Desktop”\nValueName = “ScreenSaverIsSecure”\nstrValue = “1”<\/p>\n
objReg.SetStringValue HKEY_CURRENT_USER, strKeyPath, ValueName, strValue\n<\/PRE>\n
This script starts off by defining a constant named HKEY_CURRENT_USER and setting the value to &H80000001; this lets the script know which registry hive we want to deal with. We then use this line of code to connect to the WMI service and to the Standard Registry Provider class (StdRegProv<\/B>):<\/P>
Set objReg = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\default:StdRegProv”)\n<\/PRE>\n
Next we assign values to three different variables:<\/P>\n\n\n\n\n\n
\u2022<\/TD>\n\n
strKeyPath<\/B>. The path – within HKEY_CURRENT_USER – to the registry key that needs to be changed. For the screensaver, that path happens to be Control Panel\\Desktop.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
ValueName<\/B>. The registry value to be changed. To enable password protection we need to change the ScreenSaverIsSecure value.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
strValue<\/B>. The new value to be assigned to ScreenSaverIsSecure. Set ScreenSaverIsSecure to 1 to enable password protection; set it to 0 to disable password protection.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
All we have to do then is call the SetStringValue<\/B> method and pass it all the defined parameters:<\/P>
objReg.SetStringValue HKEY_CURRENT_USER, strKeyPath, ValueName, strValue\n<\/PRE>\n
And there you go. The next time the user logs on, the screensaver will be password-protected.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Yes: although the registry is changed immediately the change won\u2019t take effect until the next time the user logs on. Because of that, you might want to include this code in a logon script; in that case, the registry gets configured before<\/I> the user logs on. Alternatively, you can make the changes and then forcibly log the user off; check the Microsoft Windows 2000 Scripting Guide<\/B><\/A> for information about logging a user off a computer.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
Of course, before you log the user out you might also want to configure the screensaver timeout value to 5 minutes. Here\u2019s a script that does just that:<\/P>
HKEY_CURRENT_USER = &H80000001<\/p>\n
strComputer = “.”<\/p>\n
Set objReg = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\default:StdRegProv”)<\/p>\n
strKeyPath = “Control Panel\\Desktop”\nValueName = “ScreenSaveTimeout”\nstrValue = “300”<\/p>\n
objReg.SetStringValue HKEY_CURRENT_USER, strKeyPath, ValueName, strValue\n<\/PRE>\n
You\u2019re right: it\u2019s almost exactly like the first script we showed you. In fact, there are only two differences:<\/P>\n\n\n\n\n
\u2022<\/TD>\n\n
The registry value we\u2019re changing is ScreenSaveTimeout (still found in the Control Panel\\Desktop key).<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
The new value being assigned to ScreenSaveTimeout is 300. Screensaver timeouts are stored as seconds: 300 seconds equals 5 minutes (300 divided by 60 = 5). If the auditors recommend a three-minute timeout value then set ScreenSaveTimeout to 180 (60 seconds times 3).<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
And there you have it. Your computers will be locked after five minutes of inactivity, and you don\u2019t have to write any complicated monitoring\/remote locking scripts. <\/P>\n
And since you asked, yes, the Scripting Guys are very grateful that they<\/I> don\u2019t get locked out after 5 minutes (or even 5 hours) of inactivity.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I lock a workstation after five minutes of inactivity, something recommended to us by our auditors?— NM Hey, NM. To tell you the truth, we don\u2019t know. Locking a computer remotely can be a bit of a problem; for more information on that, take a look at one of our […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[16,31,26,3,5],"class_list":["post-68483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-desktop-management","tag-operating-system","tag-registry","tag-scripting-guy","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I lock a workstation after five minutes of inactivity, something recommended to us by our auditors?— NM Hey, NM. To tell you the truth, we don\u2019t know. Locking a computer remotely can be a bit of a problem; for more information on that, take a look at one of our […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=68483"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/68483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=68483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=68483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=68483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}