JSI Tip 9315. How can I use a logon script to force users to configure any screen saver they wish?

If you want to allow you users the flexibility of choosing their own screen saver, but you wish to set parameters, you can use a logon script.

NOTE: This script uses REG.EXE built into Windows XP, Windows Server 2003, and later, or installed on Windows 2000 from the Support Tools on the operating system CD-ROM.

The following example:

. Verifies that a screen saver is configured. If a screen saver is NOT configured, the SCRNSAVE.EXE Value Name is missing from HKEY_CURRENT_USERControl PanelDesktop.

. Verifies that the time out is numeric and does NOT exceed 900 seconds (15 minutes).

. Verifies that the On resume, password protect box is checked.

If any of the above are NOT true, the Blank screen saver is configured for 15 minutes, with the On resume, password protect box checked, AND the user's Screen Saver tab is removed from Display Properties.

NOTE: The RunLogonScriptSync is set to 1 so that the logon script finishes before the user's desk top loads.

Add the following to the end of your logon script:

call :quiet>nul 2>&1endlocalgoto :EOF:quietset chk0=REG QUERY "HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon" /V RunLogonScriptSyncset chk1=REG QUERY "HKCUControl PanelDesktop" /V SCRNSAVE.EXEset chk2=REG QUERY "HKCUControl PanelDesktop" /V ScreenSaveActiveset chk3=REG QUERY "HKCUControl PanelDesktop" /V ScreenSaveTimeOutset chk4=REG QUERY "HKCUControl PanelDesktop" /V ScreenSaverIsSecureset OK0=Nset OK1=Nset OK2=Nset OK3=Nset OK4=N:: Wait for the logon script to complete before loading the desktop.for /F "Tokens=*" %%s in ('%chk0%^|FIND /I "0x1"') do ( set OK0=Y)if "%OK0%" EQU "N" REG ADD "HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon" /V RunLogonScriptSync /T REG_DWORD /F /D 1for /F "Tokens=*" %%s in ('%chk1%^|FIND /I "SCRNSAVE.EXE"') do ( set OK1=Y)for /F "Tokens=*" %%s in ('%chk2%^|FIND "1"') do ( set OK2=Y)for /F "Tokens=2,3" %%s in ('%chk3%^|FIND /i "REG_SZ"') do ( set OK3=%%t)for /F "Tokens=*" %%s in ('%chk4%^|FIND "1"') do ( set OK4=Y):: Verify that NONE is not configured.if "%OK1%" EQU "N" goto fix:: Verfiy that the screen saver is active.if "%OK2%" EQU "N" goto fix:: Verify that the time out is numeric and does NOT exceed 15 minutesif "%OK3%" EQU "N" goto fix@echo %OK3%|findStr "[^0-9]">nulif %ERRORLEVEL% NEQ 1 goto fixif "%OK3:~0,1%" LEQ "0" goto fixset /a OK3=%OK3%if %OK3% GTR 900 goto fix:: Verify that the On resume, password protect box is checked.if "%OK4%" EQU "Y" goto :EOF:fix:: Configure the Blank screen saver.REG ADD "HKCUControl PanelDesktop" /V SCRNSAVE.EXE /T REG_SZ /F /D "%SystemRoot%System32scrnsave.scr"REG ADD "HKCUControl PanelDesktop" /V ScreenSaveActive /T REG_SZ /F /D 1:: Set the time out to 900 seconds (15 minutes).REG ADD "HKCUControl PanelDesktop" /V ScreenSaveTimeOut /T REG_SZ /F /D 900:: Set the On resume, password protect box REG ADD "HKCUControl PanelDesktop" /V ScreenSaverIsSecure /T REG_SZ /F /D 1:: Remove the user's Screen Saver tab.REG ADD "HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem" /v NoDispScrSavPage /T REG_DWORD /F /D 1goto :EOF