search

ayohrling / local_security_policy

Apache License 2.0
6 stars 28 forks source link

18.4.9 Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set #54

Open pillarsdotnet opened 5 years ago

pillarsdotnet commented 5 years ago

18.4.9 Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set

Info

Windows includes a grace period between when the screen saver is launched and when the console is actually locked automatically when screen saver locking is enabled. The recommended state for this setting is: 'Enabled: 5 or fewer seconds'. Rationale: The default grace period that is allowed for user movement before the screen saver lock takes effect is five seconds. If you leave the default grace period configuration, your computer is vulnerable to a potential attack from someone who could approach the console and attempt to log on to the computer before the lock takes effect. An entry to the registry can be made to adjust the length of the grace period. Solution To establish the recommended configuration via GP, set the following UI path to 'Enabled: 5 or fewer seconds': Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended) Note: This Group Policy path does not exist by default. An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: The MSS settings -- Microsoft Security Guidance blog Impact: Users will have to enter their passwords to resume their console sessions as soon as the grace period ends after screen saver activation.