I'm not 100% clear on where to add registry keys for SSO.
I have pushed out the MSI and created the LocalMachineOverride key in HKLM\SOFTWARE\GrimAdmin.com\Screensaver Operations.
However, I'm not sure where the other keys go that control the timeout and actions (EWX_ExitFlag & DelayInSeconds).
I've tried putting them in HKLM\SOFTWARE\GrimAdmin.com\Screensaver Operations\ but this does not seem to work.
Thanks for the advice!
What version of Windows are you running? In particular, is the version of Windows 32-bit or 64-bit? This changes the registry location.
Is it possible you can email me a screenshot of the registry settings you have set? I should be able to see if there's anything wrong as a test. You can also set some settings using the GUI and see what appears in the HKCU area. Check out the attached image as an example.
By: cckid (offline) Monday, April 23 2012 @ 09:46 AM EDT
Hi and thanks for the help!
I've attached a screenshot. All machines are Windows 7 32-bit.
I have a domain policy specifying that the mystify.scr screensaver comes on after 10 minutes and requires a password.
I want to implement the auto-logout feature for 3 specific OU's so I pushed out the SSO msi and verified that it was installed and see that the registry keys I created are being applied so I'm not sure what else I should check at this point.
Thanks for the help!
I've dug a little more and see that the winning screensaver policy is coming from the top domain policy where I specify that after 10 minutes, a standard windows screensaver comes on and requires a password to unlock.
Do you think this would be interfering? I thought that OU specific policies won out over global ones
It's hard to say. I do not see any attached files in your post unfortunately (you have to wait for the attachment to upload completely before submitting comment - you can tell if the attachment name appears in the post edit screen). It sounds like the wrong screensaver is being applied (mystify.scr from the top level). Normally, the settings in the OU lower in the tree will take precedence over most policies above, but there is an "enforce" setting that would make a GPO always win out, even if there's one lower in the tree that says otherwise.
Are you applying the following setting in the lower OUs where the USER accounts are kept (see image as an example)?
Policy: User Configuration -> Policies - > Administrative Templates -> Control Panel -> Personalization -> Force specific screen saver
Value: Screensaver Operations.scr
Thanks again for all the tips.
I'm not sure what the problem was but I think it's working now.
I ended up removing the computer from the domain and then re-adding it before it would take the gpo.
I tried enforcing it with no luck. Then I tried disabling inheritance with no luck. After removing from domain and re-adding it, it works.
One question left is this:
If a user locks their screen and someone else log in, the original user doesn't get logged out after x minutes of inactivity. Is there any way to log out the original user?
I have a multi-user environment and want to log out users in case they forget to do so and leave for the day.