JSI Tip 9315. How can I use a logon script to force users to configure any screen saver they wish?

If you want to allow you users the flexibility of choosing their own screen saver, but you wish to set parameters, you can use a logon script.

NOTE: This script uses REG.EXE built into Windows XP, Windows Server 2003, and later, or installed on Windows 2000 from the Support Tools on the operating system CD-ROM.

The following example:

. Verifies that a screen saver is configured. If a screen saver is NOT configured, the SCRNSAVE.EXE Value Name is missing from HKEY_CURRENT_USER\Control Panel\Desktop.

. Verifies that the time out is numeric and does NOT exceed 900 seconds (15 minutes).

. Verifies that the On resume, password protect box is checked.

If any of the above are NOT true, the Blank screen saver is configured for 15 minutes, with the On resume, password protect box checked, AND the user's Screen Saver tab is removed from Display Properties.

NOTE: The RunLogonScriptSync is set to 1 so that the logon script finishes before the user's desk top loads.

Add the following to the end of your logon script:

call :quiet>nul 2>&1
endlocal
goto :EOF
:quiet
set chk0=REG QUERY "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /V RunLogonScriptSync
set chk1=REG QUERY "HKCU\Control Panel\Desktop" /V SCRNSAVE.EXE
set chk2=REG QUERY "HKCU\Control Panel\Desktop" /V ScreenSaveActive
set chk3=REG QUERY "HKCU\Control Panel\Desktop" /V ScreenSaveTimeOut
set chk4=REG QUERY "HKCU\Control Panel\Desktop" /V ScreenSaverIsSecure
set OK0=N
set OK1=N
set OK2=N
set OK3=N
set OK4=N
:: Wait for the logon script to complete before loading the desktop.
for /F "Tokens=*" %%s in ('%chk0%^|FIND /I "0x1"') do (
 set OK0=Y
)
if "%OK0%" EQU "N" REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /V RunLogonScriptSync /T REG_DWORD /F /D 1
for /F "Tokens=*" %%s in ('%chk1%^|FIND /I "SCRNSAVE.EXE"') do (
 set OK1=Y
)
for /F "Tokens=*" %%s in ('%chk2%^|FIND "1"') do (
 set OK2=Y
)
for /F "Tokens=2,3" %%s in ('%chk3%^|FIND /i "REG_SZ"') do (
 set OK3=%%t
)
for /F "Tokens=*" %%s in ('%chk4%^|FIND "1"') do (
 set OK4=Y
)
:: Verify that NONE is not configured.
if "%OK1%" EQU "N" goto fix
:: Verfiy that the screen saver is active.
if "%OK2%" EQU "N" goto fix
:: Verify that the time out is numeric and does NOT exceed 15 minutes
if "%OK3%" EQU "N" goto fix
@echo %OK3%|findStr "\[^0-9\]">nul
if %ERRORLEVEL% NEQ 1 goto fix
if "%OK3:~0,1%" LEQ "0" goto fix
set /a OK3=%OK3%
if %OK3% GTR 900 goto fix
:: Verify that the On resume, password protect box is checked.
if "%OK4%" EQU "Y" goto :EOF
:fix
:: Configure the Blank screen saver.
REG ADD "HKCU\Control Panel\Desktop" /V SCRNSAVE.EXE /T REG_SZ /F /D "%SystemRoot%\System32\scrnsave.scr"
REG ADD "HKCU\Control Panel\Desktop" /V ScreenSaveActive /T REG_SZ /F /D 1
:: Set the time out to 900 seconds (15 minutes).
REG ADD "HKCU\Control Panel\Desktop" /V ScreenSaveTimeOut /T REG_SZ /F /D 900
:: Set the On resume, password protect box 
REG ADD "HKCU\Control Panel\Desktop" /V ScreenSaverIsSecure /T REG_SZ /F /D 1
:: Remove the user's Screen Saver tab.
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispScrSavPage /T REG_DWORD /F /D 1
goto :EOF

Comments

Plain text