{"id":225,"date":"2017-11-30T21:42:15","date_gmt":"2017-11-30T21:42:15","guid":{"rendered":"http:\/\/www.edrockwell.com\/blog\/?p=225"},"modified":"2026-07-02T16:57:33","modified_gmt":"2026-07-02T16:57:33","slug":"set-screen-lock-local-policy-non-domain-server","status":"publish","type":"post","link":"https:\/\/www.edrockwell.com\/blog\/set-screen-lock-local-policy-non-domain-server\/","title":{"rendered":"How to set screen saver lock screen local policy on a non domain server"},"content":{"rendered":"

After being tasked to set up a screen saver password or a lock screen for inactivity on servers that are not joined to a domain, I decided to post this so it’s easier to find when others are searching for this.<\/p>\n

To be PCI compliant, this is a requirement for any servers that are in-scope for your payment system.<\/p>\n

For Microsoft Windows 2008 and 2012, it is easy to do but you have to set all three settings below for it to become active. This will enable a screen saver policy that locks your screen after a set time of inactivity. For PCI controlled servers, this is a requirement and must be less than 15 minutes.<\/p>\n

This is easily done if the computer is part of an Active Directory domain but not as easily done if they are members of a workgroup.<\/p>\n

How to Set the Screen Saver Lock Screen<\/h2>\n

The procedure is to open MMC snapin and add the Local Computer Policy snapin. To do this, click on the Windows button, and then simply type in MMC. For Windows 2012, select MMC snapin (mmc.exe) and not the Embedded Lockdown Manager.<\/p>\n

Then navigate to User Configuration >> Administrative Templates >> Control Panel >> Personalization (as seen in the graphic I\u2019ve attached).<\/p>\n

Set the following settings:
\nEnable Screensaver: Enabled
\nPassword protect the screen saver: Enabled
\nScreen saver timeout: Enabled with a value of 600<\/p>\n

No need to reboot. Just log out and back in and the setting will be applied. Then wait 10 minutes to verify that your screen locks.<\/p>\n

Here is a graphic of what needs to be set:<\/p>\n

\"\"<\/a>

How to set a local policy to activate the lock screen on servers.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

After being tasked to set up a screen saver password or a lock screen for inactivity on servers that are not joined to a domain, I decided to post this so it’s easier to find when others are searching for this. To be PCI compliant, this is a requirement for any servers that are in-scope […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68,92,93],"tags":[94,96,95],"class_list":["post-225","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-pci","category-security","tag-pci","tag-screensaver","tag-set-windows-lock-screen"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t