If the Password protect the screen saver setting is enabled, then all screen savers are password protected, if it is disabled then password protection cannot be set on any screen saver. Vulnerability: If a user forgets to lock their computer when they walk away it is possible that a passerby will hijack it. Counter Measure: Configure this policy setting to Enabled so that when the other screen saver settings are implemented the risk of a user's desktop session being hijacked by a passerby is reduced. Potential Impact: Users will have to provide their logon credentials when they want to access their locked desktop session. Fix: (1) GPO: User ConfigurationAdministrative TemplatesControl PanelPersonalizationPassword protect the screen saver (2) REG: HKEY_USERSSoftwarePoliciesMicrosoftWindowsControl PanelDesktop!ScreenSaverIsSecure

[enable/disable]

(1) GPO: User Configuration\Administrative Templates\Control Panel\Personalization\Password protect the screen saver (2) REG: HKEY_USERS\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaverIsSecure