Prevent Bypassing Screen Saver Password via Regedit

Securing Windows workstations requires ensuring that users cannot tamper with system policies, such as bypassing the screen saver lock by modifying registry keys. This guide details how administrators can prevent users from altering screen saver password settings in the Registry Editor (Regedit) by disabling registry editing tools, enforcing screen saver policies through Group Policy Objects (GPO), and restricting user account permissions.

1. Disable Access to Registry Editing Tools

The most direct way to stop users from changing registry values is to block their access to regedit.exe.

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to:
   User Configuration > Administrative Templates > System
3. In the right pane, double-click Prevent access to registry editing tools.
4. Select Enabled.
5. Under the Options section, set Disable regedit from running silently? to Yes to also block scripts and .reg files.
6. Click Apply and OK.

2. Enforce Screen Saver Password Policies via GPO

When screen saver settings are enforced at the policy level, individual user registry alterations are overwritten or ignored by the operating system.

1. In the Local Group Policy Editor (gpedit.msc), navigate to:
   User Configuration > Administrative Templates > Control Panel > Personalization
2. Configure the following policies:
   • Enable screen saver: Set to Enabled.
   • Password protect the screen saver: Set to Enabled.
   • Screen saver timeout: Set to Enabled and define the idle time limit in seconds (e.g., 900 for 15 minutes).
   • Force specific screen saver: Set to Enabled and enter a valid executable name (e.g., scrnsave.scr).
3. Click Apply and OK for each setting.

3. Restrict Local Administrator Privileges

Registry restrictions and Group Policies can be bypassed if a user has administrative rights on the local machine.

• Ensure standard user accounts belong only to the Users group, not the Administrators group.
• Standard users without administrative rights cannot bypass domain-level Group Policy configurations or re-enable administrative tools.

4. Lock Down Registry Key Permissions (Optional Hardening)

If granular control is required without completely disabling regedit.exe, you can restrict write permissions to the specific screen saver registry path.

1. Open regedit.exe as an administrator.
2. Navigate to:
   HKEY_CURRENT_USER\Control Panel\Desktop
3. Right-click the Desktop key and select Permissions.
4. Select the target user or group and click Advanced.
5. Edit the permission entry and change it to Read only, explicitly denying Full Control or Set Value permissions for values like ScreenSaverIsSecure, ScreenSaveActive, and ScreenSaveTimeOut.
6. Apply the changes.