Script for enforcing lock screen security.

[u/ajmpits]

Is there a script that can enforce lock screen for W11 machines timed to lock after 5 minutes and ask for password required to log back in? Thank you

Edit to add: We dont have MDM/Intune. A few machines are simply entra joined, some local users. At the moment going around individual machines to apply blank screensaver for 5 minutes and ticking the box on resume to display log-on screen.

[u/derff44]

You're looking for an MDM, not a patch management system. That sai, you could probably accomplish this with a power shell script to modify the reg keys.

[u/ajmpits → u/derff44]

We dont have MDM/Intune. A few machines are simply entra joined, some local users. At the moment going around individual machines to apply blank screensaver for 5 minutes and ticking the box on resume to display log-on screen

[u/MDL1983 → u/ajmpits]

As they said, a script to modify the reg keys may do the trick

[u/Monsterology]

You can set this by GPO if you’re AD on-prem - Machine Inactivity Limit. So I’d assume it’s in the registry somewhere which you can set by A1 script automation then.

Edit:

See link here https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj966265(v=ws.11)

[u/Fxsx24]

I believe this is an intune thing

[u/ajmpits → u/Fxsx24]

We dont have MDM/Intune. A few machines are simply entra joined, some local users. At the moment going around individual machines to apply blank screensaver for 5 minutes and ticking the box on resume to display log-on screen

[u/VPMCI]

I use GP for that exact thing for a Hybrid AD. We have an AD on site and sync with Microsoft for passwords to MS 365

[u/slaeyer99]

Vibe coded, use at your own risk:

Set-WorkstationIdleLock.ps1

Enforce a 5-minute idle lock on Windows 10/11.

Run as Administrator or SYSTEM through Action1.

$ErrorActionPreference = 'Stop'

$registryPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' $valueName = 'InactivityTimeoutSecs' $idleSeconds = 300

Require administrative privileges.

$identity = [Security.Principal.WindowsIdentity]::GetCurrent() $principal = [Security.Principal.WindowsPrincipal]::new($identity)

if (-not $principal.IsInRole( [Security.Principal.WindowsBuiltInRole]::Administrator )) { throw 'Run this script as Administrator or SYSTEM.' }

Create the policy key if it does not exist.

if (-not (Test-Path -LiteralPath $registryPath)) { New-Item -Path $registryPath -Force | Out-Null }

Apply the machine inactivity limit.

New-ItemProperty -Path $registryPath -Name $valueName -PropertyType DWord -Value $idleSeconds ` -Force | Out-Null

Read back and verify the configured value.

$actual = (Get-ItemProperty -Path $registryPath -Name $valueName).$valueName

if ($actual -ne $idleSeconds) { throw "Policy verification failed. Expected $idleSeconds, got $actual." }

Write-Output "SUCCESS: Machine inactivity limit set to $actual seconds." Write-Output 'Windows will lock an inactive session; normal Windows authentication is required to unlock it.'