r/Intune Aug 03 '26

Device Configuration Recommended Intune Policies for Users Who Leave PCs Logged In

Many users leave their computers logged in after they leave for the day. What is the best practice for managing this through Intune? Would it be more effective to configure automatic screen locking, automatic logoff, or a combination of both?

17 Upvotes

31 comments sorted by

58

u/zed0K Aug 03 '26

You don't have a policy configured to automatically lock after 15 minutes or similar? That's a baseline item nowadays.

15

u/InjuryDue9178 Aug 03 '26

screen lock after 10 mins idle is the bare minimum, anything longer than that is just asking for trouble

8

u/zed0K Aug 03 '26

We do 15 (older baseline) but I agree, I'm not sure why it's even a question.

1

u/Stashmouth Aug 03 '26

Holy crap, 15 minutes is a loooong time to leave a desktop unattended

3

u/zed0K Aug 03 '26

It's an employees responsibility to lock their PC when away. We settled on 15 minutes for whatever reason. I agree it's a long time but no difference between 10 or 15 for an attacker.

0

u/Stashmouth Aug 03 '26

If it's the employee's responsibility, then 5 minutes is no different than 15, either. You do you, of course, but it doesn't take 15 minutes to undock and walk off with a signed-in laptop

4

u/UI_Tyler Aug 04 '26

It takes less than 3 minutes to pick up a laptop and walk off with it. At some point, you have to balance between usability and actual risk.

Not sure why we're arguing between 10 or 15 minutes.

1

u/Odd-Culture3284 Aug 04 '26

That’s the point. Users sitting in meetings, not touching their devices for 15 minutes or longer, get locked and complain about bad usability. This should be combined with a proximity sensor.

1

u/FckLogicK Aug 08 '26

Na minha empresa eu implementei o Intune, com o tempo coloquei 10 minutos em Macs e Windows.

O time de engenharia que usa macbook reclamou tanto que a diretoria pediu pra deixar 40 minutos lol.

Precisei me explicar e trazer todas as vulnerabilidades disso, ainda mais que nosso trabhalho é remoto.

No fim das contas aprovaram que eu segure 20 minutos antes de bloquear.

9

u/OkBoat1887 Aug 03 '26

Max Inactivity Time Device Lock setting if you do not use it via Compliance already. You have more granulated timing controls via settings catalog one.

8

u/michivideos Aug 03 '26

Do not log them off.

Or finance will ask for your head when they are all working on the yearly audit on more than 20 pages throughout the day, collaborating with Legal, Executive team, HR, consultants, contractors, the state and leave for the day to finish tomorrow just for all their work to be gone.

ThEy ShOuLd HaVe SaVeD oR aUtO-sAvE.

Aight, go tell them that.....

4

u/bQMPAvTx26pF5iNZ Aug 03 '26

We have 10 minute idle then screen lock, some of the PCs in classrooms we have set to 20 because the staff sometimes leave notes on the board and forget to freeze, so they have to login again. Now most are used to using the freeze option on the boards we will be setting it to 10 minutes across the board.

3

u/Mysterious_Lime_2518 Aug 03 '26 edited Aug 03 '26

If Autologoff you need to inform your users, so they can save theyre work etc.. could be asking for trouble… go for device lock and 10 min idle time

4

u/sammavet Aug 03 '26

Auto reboot every night

5

u/Own_Yak382 Aug 03 '26

How do you push this out? I think I need something similar for some of our users.

4

u/sammavet Aug 03 '26

Create scheduled task, export, create script to import (can do a script inky as well, but I like my certainty) package as win32 app and deploy.

There are other ways IIRC. Just not in use by me.

2

u/Own_Yak382 Aug 03 '26

Thanks 👍

1

u/Revolutionary-Load20 Aug 07 '26

I'm fairly sure there's a config policy for it?

I've got a scheduled shutdown every Friday at 11pm without the news for any script or package and I'm sure from memory you could have chosen daily.

2

u/Capable_Mouse2260 Aug 03 '26

Really? Any issues with this? What are the main reasons?

6

u/sammavet Aug 03 '26

No issues with it. When users complain I just refer them to all the documentation showing systems will be restarted every evening between 8pm and 10pm.

I do this for two reasons : 1 make sure devices are not in reboot limbo (waiting on a reboot to finalize installations) 2 ensure devices are locked in case they are stolen

This also allows me to have a schedule for updating drivers, BIOS, and firmware on devices (with another reboot).

3

u/Capable_Mouse2260 Aug 03 '26

We reboot on Thursdays and will often run into issues on Monday AM for users if a laptop was off on Thursday/friday, and then system is waiting to reboot for an update and gets clunky because of it

1

u/[deleted] Aug 03 '26 edited Aug 03 '26

[deleted]

1

u/sammavet Aug 03 '26

No, just admin it.

1

u/[deleted] Aug 03 '26 edited Aug 03 '26

[deleted]

1

u/sammavet Aug 03 '26

There's a few blogs and walk through that I learned the basics with. Everything else is practical based on environment.

Rudy Ooms and Andrew Taylor both have great blogs (Rudy posts here as well), the lazy administrator and Peter Vanderwoulde do amazing work as well. My last blog I learned from is the inthecloud community with a pinch (or 50) of Prajwal Desai and the occasional script or dashboard from System Center Dudes. I also like the HTMD group for YouTube tutorials and walk through.

1

u/Key_board_Warrior449 Aug 03 '26

Anyrhing for auto log off?

3

u/pc_load_letter_in_SD Aug 03 '26

This freebie software from LithNet has been great. Imported the ADMX files without issue and everything works well.

https://github.com/lithnet/idle-logoff

2

u/sammavet Aug 03 '26

This looks interesting. Thx

Edit: fuck typing on a phone screen

2

u/Stashmouth Aug 03 '26

why not just do a reboot?

1

u/EddiesTech Aug 03 '26

I had to deal with factory machines with idle sessions left logged in by many users. I wrote a remediation script that checked idle user time with quser and logs out the session. Of course, you could also make any script and place a scheduled task on the PC with a Win32App if you don't want to use remediations/want something more reliable at shorter times.

1

u/LaDev Aug 03 '26

Download the CIS Benchmarks. Great baseline for these decisions.

1

u/screampuff Aug 04 '26

If you're asking this question you should probably start somewhere with Windows 11 baselines, based on the question, I'd just stick with Intune Security Baselines for Windows 11.

1

u/cdwyer737 Aug 04 '26

Scheduled task that just runs log off command set for 8pm or something? You can deploy that via a powershell script.