0015 - GPO (Group Poliy Object) - Account Lockout & Device Timeout Policies (Screensaver)

This video looks at the Default Domain Policy and how we can amend this to create a security policy that helps aid against multiple incorrect password attempts for an AD User Account. (Account Lockout Thresholds) Furthermore, we then look at creating a new GPO (Group Policy Object) which forces a 'lock-out'/Screensaver to initiate. Resources: Cyber Essentials Scheme: overview ; https://www.gov.uk/government/publica... About Cyber Essentials; https://www.ncsc.gov.uk/cyberessentia... Sources: Account Lockout Policy; https://docs.microsoft.com/en-us/wind... NOTE: Extract; "Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting Interactive logon: Machine inactivity limit. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine). You can activate the screen saver by enabling the Group Policy User Configuration\Administrative Templates\Control Panel\Personalization\Enable screen saver. This policy setting allows you to control the locking time by using Group Policy." "Because this policy setting was introduced in Windows Server 2012 and Windows 8, it can only be set locally on those computers that contain this policy setting, but it can be set and distributed through Group Policy to any computer running the Windows operating system that supports Group Policy." Full documentation here; https://docs.microsoft.com/en-us/wind... How to create and manage the Central Store for Group Policy Administrative Templates in Windows: ADMX GPO (Group Policy Objects) Administrative Templates; Windows 8.1 / Windows Server 2012 R2 - Windows 10 May 2021 Update (21H1) https://docs.microsoft.com/en-us/trou... Non-Microsoft ADMX templates/links; https://admx.help/