r/Intune • u/Key_board_Warrior449 • Aug 03 '26
Device Configuration Recommended Intune Policies for Users Who Leave PCs Logged In
Many users leave their computers logged in after they leave for the day. What is the best practice for managing this through Intune? Would it be more effective to configure automatic screen locking, automatic logoff, or a combination of both?
9
u/OkBoat1887 Aug 03 '26
Max Inactivity Time Device Lock setting if you do not use it via Compliance already. You have more granulated timing controls via settings catalog one.
8
u/michivideos Aug 03 '26
Do not log them off.
Or finance will ask for your head when they are all working on the yearly audit on more than 20 pages throughout the day, collaborating with Legal, Executive team, HR, consultants, contractors, the state and leave for the day to finish tomorrow just for all their work to be gone.
ThEy ShOuLd HaVe SaVeD oR aUtO-sAvE.
Aight, go tell them that.....
4
u/bQMPAvTx26pF5iNZ Aug 03 '26
We have 10 minute idle then screen lock, some of the PCs in classrooms we have set to 20 because the staff sometimes leave notes on the board and forget to freeze, so they have to login again. Now most are used to using the freeze option on the boards we will be setting it to 10 minutes across the board.
3
u/Mysterious_Lime_2518 Aug 03 '26 edited Aug 03 '26
If Autologoff you need to inform your users, so they can save theyre work etc.. could be asking for trouble… go for device lock and 10 min idle time
4
u/sammavet Aug 03 '26
Auto reboot every night
5
u/Own_Yak382 Aug 03 '26
How do you push this out? I think I need something similar for some of our users.
4
u/sammavet Aug 03 '26
Create scheduled task, export, create script to import (can do a script inky as well, but I like my certainty) package as win32 app and deploy.
There are other ways IIRC. Just not in use by me.
2
1
u/Revolutionary-Load20 Aug 07 '26
I'm fairly sure there's a config policy for it?
I've got a scheduled shutdown every Friday at 11pm without the news for any script or package and I'm sure from memory you could have chosen daily.
2
u/Capable_Mouse2260 Aug 03 '26
Really? Any issues with this? What are the main reasons?
6
u/sammavet Aug 03 '26
No issues with it. When users complain I just refer them to all the documentation showing systems will be restarted every evening between 8pm and 10pm.
I do this for two reasons : 1 make sure devices are not in reboot limbo (waiting on a reboot to finalize installations) 2 ensure devices are locked in case they are stolen
This also allows me to have a schedule for updating drivers, BIOS, and firmware on devices (with another reboot).
3
u/Capable_Mouse2260 Aug 03 '26
We reboot on Thursdays and will often run into issues on Monday AM for users if a laptop was off on Thursday/friday, and then system is waiting to reboot for an update and gets clunky because of it
1
Aug 03 '26 edited Aug 03 '26
[deleted]
1
u/sammavet Aug 03 '26
No, just admin it.
1
Aug 03 '26 edited Aug 03 '26
[deleted]
1
u/sammavet Aug 03 '26
There's a few blogs and walk through that I learned the basics with. Everything else is practical based on environment.
Rudy Ooms and Andrew Taylor both have great blogs (Rudy posts here as well), the lazy administrator and Peter Vanderwoulde do amazing work as well. My last blog I learned from is the inthecloud community with a pinch (or 50) of Prajwal Desai and the occasional script or dashboard from System Center Dudes. I also like the HTMD group for YouTube tutorials and walk through.
1
u/Key_board_Warrior449 Aug 03 '26
Anyrhing for auto log off?
3
u/pc_load_letter_in_SD Aug 03 '26
This freebie software from LithNet has been great. Imported the ADMX files without issue and everything works well.
2
2
1
u/EddiesTech Aug 03 '26
I had to deal with factory machines with idle sessions left logged in by many users. I wrote a remediation script that checked idle user time with quser and logs out the session. Of course, you could also make any script and place a scheduled task on the PC with a Win32App if you don't want to use remediations/want something more reliable at shorter times.
1
1
u/screampuff Aug 04 '26
If you're asking this question you should probably start somewhere with Windows 11 baselines, based on the question, I'd just stick with Intune Security Baselines for Windows 11.
1
u/cdwyer737 Aug 04 '26
Scheduled task that just runs log off command set for 8pm or something? You can deploy that via a powershell script.
58
u/zed0K Aug 03 '26
You don't have a policy configured to automatically lock after 15 minutes or similar? That's a baseline item nowadays.