screensaver lockout 1

[tsmi]

Hello;
How can I lock out the ability of the user to change the screen saver. Specifically, I would like to lock the ability of the user to change the time-to-activation so in 10 minutes the screen saver will activate and require a password to get back in. Several of my users like to change the timeout to 999 minutes...regardless of company policy.
Thanks in advance
Tony

 

[glegg]

Do you have a Windows 2000 Active Directory domain? If yes, you can create a Group Policy Object that will specify which screen saver the users have, password protect it, and set how long the screen saver time out is. All three policies can be found by opening a GPO and going to User Configuration> Administrative Templates> Control Panel> Display. The three policies are the last three listed.

 

[tsmi]

glegg;
Thanks for the response. No, we are not part of a domain...long story. Domains around here are being assimilated into the greater borg collective so to remain somewhat autonomous, my several dozen PC's are part of a workgroup. I also have a couple hundred unix boxes which are on their own domain and interestingly enough, they take up less of my time to administer than 3 dozen PC's!
Any further suggestions would be greatly appreciated.

Tony

 

[glegg]

Are the pc's in your workgroup Windows 2000 Pro machines? If so, and I know this will be a pain, you can create a GPO on each local machine using the same settings. As long as the users aren't in the admin group on their machines, they can't make any changes to the GPO or the screen saver that you set for them.

 

[tsmi]

glegg;
They are all Win2k Pro boxes and the users are not part of the admin group except for a couple of trusted souls. Would you outline for me the process?
Thanks for all your help!

Tony

 

[glegg]

Sure!

1. Start>Run Type mmc
2. Click on the "Console" button and select add/remove snap-in from the drop down menu (Console1-[Console Root] should be empty as this is a new mmc).
3. On the add/remove snap-in window that appears, click on "Add".
4. The Add Standalone Snap-in window appears, go to "Group Policy" and click "Add". By default, "Local computer" is listed (which is what you want).
5. Click "Finish" and then "Close" (to shut the snap-in window)and then "O.K." on the Add/Remove Snap-in window.
6. Expand the Local Computer Policy in the console root and then expand User Configuration.
7. Expand the Administrative Templates and then expand Control Panel.
8. Click on the "Display" folder and you can see the policy settings available to you in the right hand window.
9. Select the "Screen Saver executable name" to set which screen saver to use and enable; select "Password protect the screen saver" and enable; then select the last policy "Screen Saver timeout". Enable the policy and set the time (in seconds).
10. Close the mmc (and save it). You may have to restart the machine to apply. When you open properties on the desktop, the password protect and screen saver name will be grayed out. The time out will not be grayed out but if the user changes the time, it will not be applied or saved.

 

[tsmi]

That's exactly what I was looking for and it worked as advertised. You da man glegg!

Many thanks!

Tony

 

[pbxman]

*ding* for glegg pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.