Policies/

Screen lock enabled

Guillaume Ross

Checks if the screen lock is enabled and configured to lock the system within 30 minutes or less.

Control

Create or edit a configuration profile with the following information:

Create or edit the following script and configure it to run when the check fails:

Check

Use the policy below to verify:

Query PowerShellNEW BashNEW

SELECT 1 FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs' AND CAST(data as INTEGER) <= 1800;

$regPath = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
$value = (Get-ItemProperty -Path $regPath -Name 'InactivityTimeoutSecs' -ErrorAction SilentlyContinue).InactivityTimeoutSecs
if ($value -and ([int]$value) -le 1800) {
    Write-Output 1
} else {
    Write-Output 0
}