We wrote awhile ago about how to enforce password protected screensavers in Windows. Password protected screensavers that automatically kick in are nice because they secure the users' desktop when they walk away, which protects their email, local documents, etc. in addition to their PeopleSoft sessions. Lots of customers that use our Desktop Single Signon for PeopleSoft product have implemented this.

In some cases though, locking the current session isn't the desired behavior. In kiosk environments or other types of shared workstations, you want someone else to be able to login, so having the workstation locked to the last user isn't good.

It turns out that Microsoft has a screensaver, winexit.scr, that will log the user out when the screensaver activates. The screensaver is part of the Windows Resource Kits; here's the download for the Windows Server 2003/Windows XP Resource Kit. There are lots of writeups out there about using winexit.scr, but the best one that I found was from David Carlin at Case Western Reserve University. His blog post describes his experience implementing this at one of the computer labs there.

There is at least one commercial product out there (ActiveExit XP) that handles similar requirements, although we don't have any experience with it.

Labels: 2009, Security, Sysadmin, Windows