Group Policy - Amount of idle time required before suspending session not working?

[richardy2k04]

I have a GPO in my domain that is intended to lock the workstations after 10 minutes of inactivity. I use the following setting to do this:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

Microsoft Network Server: Amount of idle time required before suspending session.

So this setting does what i want it to do...for SOME of my machines SOME of the time. All the machines are getting and applying the policy, but it isnt actually working on some of them, but only sporadically. I confirmed that the workstations are in the correct OU, the GPO has the correct permissions, and when i check the machines locally, the policy is getting applied. Anyone ever had any issue like this with this setting?

 

[linney]

Not much activity on your question here, have you thought about posting in one of the Server Forums too?


Microsoft: Windows Server 2012

http://www.tek-tips.com/threadminder.cfm?pid=1814

 

[cdogg]

Richard,
Are you modifying an existing GPO or is this a new one you've created? If it's an existing GPO, then check to see if the "Apply once and do not reapply" option is set to Yes. If it is, then that might explain why some get it and others don't.



-Carl
"The glass is neither half-full nor half-empty: it's twice as big as it needs to be."

[tab][navy]For this site's posting policies, click [/navy]here.

 

[richardy2k04]

cdogg,

i thought you might be onto something, as i am noticing that wiping the affected machines and reinstalling windows seems to be correcting the problem, but this particular GP setting does not have the "apply once and do not reapply" option. I think that only applies to preferences, and this is a policy. Id rather not redeploy windows to 700+ machines.

Linney - thanks for the advice. I posted this over in the 2012 forum as well now.

 

[cdogg]

Is this GPO new to the environment, or are you updating an existing one? If it previously existed, then try creating a new GPO with that setting. That should take care of it.

-Carl
"The glass is neither half-full nor half-empty: it's twice as big as it needs to be."

[tab][navy]For this site's posting policies, click [/navy]here.

 

[richardy2k04]

This is a GPO that has been in the environment for a while. I will give that a try and see if i there is any change. Will post results shortly.