Prevent Screen Saver Password Bypass in Regedit

This guide explains how to use the Windows Registry Editor (Regedit) to enforce screen saver password protection and prevent local users from bypassing or modifying lock requirements. By applying these registry policies under the system-wide Machine hive, local users without administrative rights will be forced into an automated, password-protected lock state after a specified period of inactivity.

Step 1: Open the Registry Editor

  1. Press Win + R on your keyboard to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

Step 2: Navigate to the Control Panel Policy Key

Navigate through the left sidebar to the following path to apply the policy globally for all local users:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop

Note: If the Control Panel or Desktop keys do not exist under Windows, right-click the parent key, select New > Key, and create them with the exact names shown above.

Step 3: Create and Configure Required Registry Values

To enforce the screen saver password and prevent bypass, create four String Value (REG_SZ) entries inside the Desktop key:

  1. Enforce Password Protection:
    • Right-click an empty area in the right pane, select New > String Value, and name it ScreenSaverIsSecure.
    • Double-click ScreenSaverIsSecure and set its Value data to 1.
    • Purpose: Requires the user to enter their account password to unlock the screen when returning.
  2. Force the Screen Saver to be Active:
    • Right-click, select New > String Value, and name it ScreenSaveActive.
    • Double-click ScreenSaveActive and set its Value data to 1.
    • Purpose: Ensures the screen saver cannot be turned off by local users.
  3. Specify the Screen Saver Executable:
    • Right-click, select New > String Value, and name it SCRNSAVE.EXE.
    • Double-click SCRNSAVE.EXE and set its Value data to C:\Windows\System32\scrnsave.scr (or another valid .scr path).
    • Purpose: Defines a mandatory screen saver file for the system to execute.
  4. Set the Timeout Duration:
    • Right-click, select New > String Value, and name it ScreenSaveTimeOut.
    • Double-click ScreenSaveTimeOut and set its Value data to the desired timeout in seconds (for example, 600 for 10 minutes or 900 for 15 minutes).
    • Purpose: Establishes how long the system must remain idle before the screen saver and lock engage.

Step 4: Apply the Changes

  1. Close the Registry Editor.
  2. Restart your computer, or sign out and sign back in, to apply the new registry rules across all local accounts.