Users Keeps Getting Locked

[John]

I have a PC with WinXP Pro SP3 with the latest patches installed. This PC is
shared by 3 users during office hour. They take turns logging on/off to
Windows Server 2003 AD domain.

Here's the problem:
When a user logs on and leaves the PC about 30 minutes or longer, the PC
locks (similar to manually clicking "lock computer"). The 2 other users
can't use the PC until currently logged on user comes back to unlock it.

My solution is to stop the system from asking for password after being left
idle for a period.

So I went to Power Options and change the settings to Presentation (Never
Turn off monitor, Never turn off HD, Never go to system standby). Apply the
same settings to all 3 users. Restart PC.

They're still locked.

I then checked the BIOS APM settings.

Here's the before:
APM BIOS mode: Enabled
Standby Timeout: 30 min
Hard disk timeout: Disabled

I thought BIOS APM settings were causing the problem so I changed them to:
APM BIOS mode: Disabled
Standby Timeout: Disabled
Hard disk timeout: Disabled

Save Settings.

Users are still locked after roughly about 30 minutes of idle time. None of
the power management settings are honored. Btw, screen saver is disabled.

Is there anything else to check?

 

[VanguardLH]

I have a PC with WinXP Pro SP3 with the latest patches installed. This PC is
shared by 3 users during office hour. They take turns logging on/off to
Windows Server 2003 AD domain.

Here's the problem:
When a user logs on and leaves the PC about 30 minutes or longer, the PC
locks (similar to manually clicking "lock computer"). The 2 other users
can't use the PC until currently logged on user comes back to unlock it.

My solution is to stop the system from asking for password after being left
idle for a period.

So I went to Power Options and change the settings to Presentation (Never
Turn off monitor, Never turn off HD, Never go to system standby). Apply the
same settings to all 3 users. Restart PC.

They're still locked.

I then checked the BIOS APM settings.

Here's the before:
APM BIOS mode: Enabled
Standby Timeout: 30 min
Hard disk timeout: Disabled

I thought BIOS APM settings were causing the problem so I changed them to:
APM BIOS mode: Disabled
Standby Timeout: Disabled
Hard disk timeout: Disabled

Save Settings.

Users are still locked after roughly about 30 minutes of idle time. None of
the power management settings are honored. Btw, screen saver is disabled.

Is this host on a domain? If so, checked with the IT admins regarding
what policies they push onto a host when a user logs onto their domain?

 

[John]

Is this host on a domain? If so, checked with the IT admins regarding
what policies they push onto a host when a user logs onto their domain?

I am the admin. There's no policies controlling this settings. The rest of
the PCs are fine except this one.

 

[smlunatick]

I am the admin. There's no policies controlling this settings. The rest of
the PCs are fine except this one.

Check the Screen Saver settings and uncheck "on resume, password
protect" option.

 

[John]

Already mentioned towards the end of my first post. Here it is again:

 

[VanguardLH]

VanguardLH wrote ...

I am the admin. There's no policies controlling this settings. The rest of
the PCs are fine except this one.

Okay, let's clarify just what "locked" means? Does it mean:
- Screen saver activates.
- Current logged on user is logged out and back to login screen?
- Host is in a low-power mode (standby or hibernate)?

Are you using the "blank screen" screensaver or one that paints an image
on the screen? If using a non-blank screensaver, and when the "lockout"
occurs, do you see the screensaver or a black screen?

Policies are pushed to a host and control registry settings. Is any of
these users of the problematic host logging on under an admin-level
account? If so, did you check all startup item (using, say,
SysInternal's AutoRuns) to check if one of them added a startup item
which runs a .reg file that undoes any policy settings? I did this at
work for a shared host where we didn't want to give out a login password
but company policy was to force the screen saver to lock the workstation
after 15 minutes of inactivity. With the knowledge of the IT folks (who
simply passed the buck by saying mgmt told them to establish this policy
and they couldn't change it on a per-host basis), and because the
accounts were under the domain Administrators group (for this host, not
for the PDC), we could add a "regedit.exe /s <undopolicy>.reg" shortcut
to the Startup group to undo this screen saver domain policy. So I'd
check what startup items there are.

Also, does the problem still occur if you reboot the host into Safe Mode
w/Networking?

Just a guess but is Fast User Switching (FUS) enabled? When you see the
login screen, is it that Fisher-Price style Welcome Screen showing
multiple user accounts with pretty little icons? Or do you get the
classic Windows login screen (and also have set policy to require
Ctrl+Alt+Del to open the login screen)?

Have you simply tried logging on locally (i.e., use a local user account
instead of logging under a domain account) to see if the problem
continues? If the problem goes away when logging onto a local account
then policies are the source of the problem. I guess you could yank the
CAT5 cable, disable the LAN connectoid, or disable the Wifi device in
Device Manager when logging on locally but I don't believe domain
policies get pushed onto a host when logging onto a local account (i.e.,
the account is only defined on the local host and not managed by the
PDC).

 

[John]

Okay, let's clarify just what "locked" means? Does it mean:
- Screen saver activates.
- Current logged on user is logged out and back to login screen?
- Host is in a low-power mode (standby or hibernate)?

Screen saver is DISABLED.
Currently logged on user stays logged on but screen goes to:
"This computer is in use and has been locked"
Only DomainName\John or an Administrator can unlock this computer

If John is away from the PC or out to lunch, no one can use it. Once again,
this is a shared PC. Users should be able to log John out while he's away
and log as him/herself.

Are you using the "blank screen" screensaver or one that paints an image
on the screen? If using a non-blank screensaver, and when the "lockout"
occurs, do you see the screensaver or a black screen?

SCREEN SAVER IS DISABLED. SCREEN SAVER IS DISABLED. SCREEN SAVER IS
DISABLED.
I don't mean to be rude. Just hope you see it this time.

Policies are pushed to a host and control registry settings. Is any of
these users of the problematic host logging on under an admin-level
account?

No. All users are regular users in the Domain Users (domain) group. NOT
Admin, NOT Power User.
AFAIK, there is no policy to control Power Settings (I'm not talking about
screen saver) without an add-on software. In addition to it, I don't have
domain wide screen saver GPO set to enabled. I don't even know if there's
such setting.

Also, other PCs in the same domain don't have this type of problem.
Therefore I conclude that it is NOT related to domain or system wide policy.
My best guess is that this PC might be ignoring all power management
settings. It could be a defective PC.

I did this at
work for a shared host where we didn't want to give out a login password
but company policy was to force the screen saver to lock the workstation
after 15 minutes of inactivity.

I'd like to do the other way. Never lock the workstation so other users can
kick out currently logged on user. Then log on as him/herself to the domain.

Also, does the problem still occur if you reboot the host into Safe Mode
w/Networking?

I've never tried that.

Just a guess but is Fast User Switching (FUS) enabled? When you see the
login screen, is it that Fisher-Price style Welcome Screen showing
multiple user accounts with pretty little icons? Or do you get the
classic Windows login screen (and also have set policy to require
Ctrl+Alt+Del to open the login screen)?

Windows classic login screen - Press Ctrl Alt Del to login. Pretty much all
PCs that have joined AD domain use this classic type login screen.

Have you simply tried logging on locally (i.e., use a local user account
instead of logging under a domain account) to see if the problem
continues?

Not yet. The machine is used daily. I gotta give them a loaner if I want to
take it away to test it. I'll see if I have a loaner PC ready.

Thanks for your reply.

 

[Bob I]

Windows key + "L" will lock the PC. If John locks the PC and walks away,
you have two choices, Admin unlocks it and John loses his work, or you
reboot and John loses his work.

 

[John]

Thanks but I already know that.
Problem is if the PC is idle for about 30 min, it's locked. I want it to
remain unlocked forever so everyone else can use it. I've done everything I
know to disable auto lock. Nothing seems to work.

 

[Bob I]

Who "disabled" the Screen Saver? I suspect that the SS was set to
require you key in the Password to get back to the Desktop and kick in
after 30 minutes. I would say that the timer was not disabled before the
SS was disabled. So re-enable the SS, clear the "lock down timer" then
disable the SS. On the other hand if this is a remotely managed PC then
the Domain GPO may be what is setting the lock down, and you will need
to talk to the System Admin.

 

[John]

Who "disabled" the Screen Saver?
Me

I suspect that the SS was set to require you key in the Password to get
back to the Desktop and kick in after 30 minutes.

Screen saver is disabled (tired of repeating this so many times by now).
Btw, I know the option to ask for password. That doesn't matter because SS
is disabled. Here's what is says:

Screen Save (None)

There.

I would say that the timer was not disabled before the SS was disabled. So
re-enable the SS, clear the "lock down timer" then disable the SS.

I'll give that a try.

On the other hand if this is a remotely managed PC then the Domain GPO may
be what is setting the lock down, and you will need to talk to the System
Admin.

I just talk to myself (Admin). Me say there is no policy to lock down PCs.
All other PCs aren't showing this symptom.

 

[VanguardLH]

Just a thought. Did you ever check what tasks were defined in the
user's Task Scheduler (either to run under his account or the System or
an admin account)?

 

[John]

Good question. I don't think there's any but I've got to check that.
I'm beginning to suspect IBM proprietary software (this is an IBM
ThinkCentre desktop PC). Btw, I've just asked the users if the lock-up
problem is still there or not. They can't answer it (meaning that they have
not seen it locked since my last tweak). It doesn't mean that it's been
resolved. It's possible that the past few days the PC is always busy (being
used). It doesn't have a chance to sit idle for 30 minutes or so. Therefore,
it never locks.

Thanks to all of you for your reply.