Detections
Analytics

4.5.10 (L1) Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set to 'Enabled: 5 or fewer seconds'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Windows includes a grace period between when the screen saver is launched and when the console is actually locked automatically when screen saver locking is enabled.

The recommended state for this setting is: Enabled: 5 or fewer seconds

The default grace period that is allowed for user movement before the screen saver lock takes effect is five seconds. If you leave the default grace period configuration, your computer is vulnerable to a potential attack from someone who could approach the console and attempt to log on to the computer before the lock takes effect. An entry to the registry can be made to adjust the length of the grace period.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: 5 or fewer seconds

Administrative Templates\MSS (Legacy)\MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)

Impact:

Users will have to enter their passwords to resume their console sessions as soon as the grace period ends after screen saver activation.

See Also

https://workbench.cisecurity.org/benchmarks/21719

Item Details

References: CSCv7|16.11

Plugin: Windows

Control ID: 41adc4cbebbcfaa0d4a56e41ce83563bdaf85dd93c85186e24bd5470c72d2962