02 — Endpoint Security — Automatic Screen Lock & Inactivity Policy - rafaelribeiro-s/it-support-sysadmin-portfolio GitHub Wiki

📋 Case Study: Endpoint Security — Automatic Screen Lock & Inactivity Policy

🏢 Enterprise Environment Context

  • Company Name: NexaCorp Solutions Ltd.
  • Industry: Cloud Financial Services
  • Ticket ID: INC-804367
  • Department: Finance Operations
  • Requester: Finance Operations Team

👤 Employee Profile

  • Full Name: Daniel Carter
  • Username: d.carter
  • Employee ID: NX-8821
  • Job Title: Financial Operations Analyst
  • Department: Finance Operations
  • Assigned Workstation: NX-WS-FIN02

🛠️ IT Support Assignment

  • Assigned Analyst: Rafael Ribeiro
  • Role: IT Support & Systems Administrator

Security Requirements

The workstation must follow the organization's endpoint security requirements for unattended devices.

The workstation must:

  • Automatically enter a protected state after one minute of inactivity.
  • Require user authentication when the session is resumed.
  • Preserve the existing user session after successful authentication.
  • Reduce the risk of unauthorized access when the workstation is left unattended.

The workstation must not allow an unattended active session to remain accessible without authentication.

📩 Help Desk Ticket Description

  • Ticket: INC-804367
  • Subject: Endpoint Security Configuration — Automatic Workstation Lock

Request

The Finance Operations team has requested the configuration of workstation NX-WS-FIN02 for Daniel Carter, a Financial Operations Analyst.

Because the workstation may be used to access corporate and financial information, the workstation must automatically enter a protected state after a defined period of user inactivity.

Corporate endpoint security requirements specify that unattended workstations must automatically lock after one minute of inactivity and require user authentication before access to the existing session is restored.

The configuration must be tested and documented as part of the workstation security baseline.

🎯 Key Technical Objectives for the Lab

The purpose of this lab is to implement and validate an automatic workstation lock control on a Windows endpoint.

The following objectives must be completed:

  1. Configure the workstation to activate a screen saver after one minute of inactivity.
  2. Configure Windows to require authentication when the session is resumed.
  3. Validate that the workstation enters the protected state after the configured inactivity period.
  4. Verify that returning to the workstation requires user authentication.
  5. Confirm that the existing user session is restored after successful authentication.
  6. Document the configuration and verification evidence.
  7. Record troubleshooting activities and lessons learned.

🧪 Lab Environment

The endpoint security control was implemented and validated on virtualized Windows workstation representing a corporate Finance Operations endpoint.

Component Configuration
Virtualization Platform Oracle VirtualBox
Guest Operating System Windows 11 Enterprise
Architecture x64
CPU 4 vCPUs
Memory 8 GB
Storage 80 GB VDI
Firmware UEFI
Secure Boot Enabled
TPM 2.0
Network NAT
Workstation Name NX-WS-FIN02
Test User d.carter
User Role Standar User
Administrative Account NexaAdmin

Test Scope

The laboratory focuses specifically on endpoint session security and automatic inactivity protection.

The test environment was intentionally isolated within a virtual machine to allow the security configuration to be implemented and validated without affecting a production workstation.

The following controls were within the scope of this lab:

  • Automatic screen saver activation after one minute of inactivity.
  • Authentication requirement when resuming the protected session.
  • Preservation of the existing user session after successful authentication.
  • Validation of the test user's administrative privilege boundary.
  • Collection of configuration and behavioral evidence.

EV-01 — Workstation and User Identity

The workstation identity and active user session were validated using Command Prompt.

hostname
NX-WS-FIN02

whoami
nx-ws-fin02\d.carter

The results confirm that the test was performed on workstation NX-WS-FIN02 using the d.carter user account

Validation Result: PASS

EV-02 — Test User Account

The d.carter account was inspected using the Windows net user command.

net user d.carter

The command output was used to verify the local account configuration and confirm that the test account was available for the endpoint security validation.

Validation Result: PASS

EV-03 — Local Administrator Group

The local Administrators group was inspected using:

net localgroup Administrators

The command output confirmed that the d.carter account is not a member of the local Administrator group.

This confirms that the test account operates without local administrative privileges during the endpoint security validation.

Validation Result: PASS

EV-04 — Windows Lock Screen

Location: Settings > Personalization > Lock screen

This evidence documents the Windows Lock screen configuration area before applying the endpoint security control.

The Lock screen settings were reviewed as part of the initial workstation configuration assessment.

Purpose: Establish the Windows Lock screen configuration context before configuring the automatic screen saver control.

Validation Result: PASS

EV-05 — Screen Saver Configuration Access

Location: Personalization > Lock screen > Screen saver

This evidence documents access to the Windows Screen Saver Settings interface used to configure the workstation inactivity control.

The screen saver configuration interface was accessed before making the required security changes.

Purpose: Identify the Windows configuration interface used to implement the automatic screen lock control.

Validation Result: PASS

EV-06 — Screen Saver Configuration Baseline

Configuration State:

  • Screen saver: None
  • Settings: Disabled
  • Preview: Disabled
  • Wait: Disabled
  • On resume, display logon screen: Unchecked

This evidence captures the workstation's screen saver configuration before the security control was implemented.

No screen saver was configured at the beginning of the lab, and the inactivity timeout and authentication-on-resume options were therefore not active.

Purpose: Document the initial configuration state and provide a before-and-after comparison for the security control.

Validation Result: BASELINE

EV-07 — Automatic Screen Lock Configuration

Configuration State:

  • Screen saver: Blank
  • Wait: 1 minute
  • On resume, display logon screen: Enabled

The workstation was configured to activate the Blank screen saver after one minute of user inactivity.

The On resume, display logon screen option was enabled to require user authentication before the existing session could be accessed again.

Purpose: Implement the endpoint security requirement for automatic protection of an unattended workstation.

Validation Result: PASS

EV-08 — Automatic Screen Saver Activation

The workstation was left inactive for the configured one-minute period.

After the inactivity timeout elapsed, the workstation automatically activated the Blank screen saver.

This confirmed that the configured inactivity timeout was being enforced through actual workstation behavior.

Expected Result: The screen saver should activate automatically after one minute of inactivity.

Observed Result: The Blank screen saver activated automatically after the configured inactivity period.

Validation Result: PASS

EV-09 — Authentication Required on Resume

After the screen saver was activated, the Enter key was pressed to resume interaction with the workstation.

Windows displayed the d.carter user profile and requested a password before allowing access to the existing session.

This confirmed that the workstation did not return directly to the active desktop and that authentication was required after the inactivity protection was triggered.

Expected Result: User authentication should be required, before the existing session can be accessed.

Observed Result: Windows displayed the d.carter authentication prompt and required a password.

Validation Result: PASS

EV-10 — Existing User Session Restored

The d.carter password was entered successfully, and the workstation returned to the existing user session.

The session was restored without starting a new user session.

This confirmed that the configured control protected the unattended workstation while preserving the existing user session after successful authentication.

Expected Result: Successful authentication should restore the existing user session.

Observed Result: The d.carter session was successfully restored after authentication.

Validation Result: PASS

🔐 Security Validation

The configured endpoint security control was validated through a controlled inactivity test on workstation NX-WS-FIN02.

Validation covered both the configured security settings and the workstation's observed behavior.

1. Configuration Validation

The following screen saver security settings were configured:

  • Screen saver: Blank
  • Inactivity timeout: 1 minute
  • Authentication on resume: Enabled

The configuration was saved successfully before the behavioral test was performed.

Evidence: EV-07 — Automatic Screen Lock Configuration

Validation Result: PASS

2. Automatic Protection Test

The workstation was left inactive for the configured one-minute period.

After the timeout elapsed, the Blank screen saver activated automatically.

This confirmed that the configured inactivity timeout was being enforced by the workstation.

Expected Result: The screen saver should activate automatically after one minute of inactivity.

Observed Result: The Blank screen saver activated automatically after the configured inactivity period.

Evidence: EV-08 — Automatic Screen Saver Activation

Validation Result: PASS

3. Authentication Boundary Validation

After the screen saver was activated, the workstation was accessed using the Enter key.

Windows displayed the d.carter user profile and requested password authentication before allowing access to the existing session.

This confirmed that the workstation did not return directly to the active desktop without authentication.

Expected Result: Authentication should be required before the existing user session can be accessed.

Observed Result: Windows displayed the d.carter authentication prompt and required a password.

Evidence: EV-09 — Authentication Required on Resume

Validation Result: PASS

4. Session Recovery Validation

The d.carter password was entered successfully.

Windows returned to the existing user session without requiring a new session to be started.

This confirmed that the inactivity control protected the unattended workstation while preserving the existing user session after successful authentication.

Expected Result: Successful authentication should restore the existing user session.

Observed Result: The d.carter session was successfully restored after authentication.

Evidence: EV-10 — Existing User Session Restored

Validation Result: PASS

Security Validation Summary

The complete endpoint security control was successfully validated:

User inactivity
      ↓
1-minute timeout
      ↓
Blank screen saver activated
      ↓
User interaction
      ↓
Authentication required
      ↓
d.carter authentication
      ↓
Existing session restored

The observed workstation behavior matched the configured endpoint security requirement for protecting an unattended Windows session.

🛠️ Troubleshooting

Screen Saver Configuration Initially Disabled

Issue: The Screen Saver Settings interface initially displayed None as the selected screen saver. The Settings, Preview, and Wait controls were unavailable, and On resume, display logon screen was not enabled.

Initial State:

  • Screen saver: None
  • Settings: Disabled
  • Preview: Disabled
  • Wait: Disabled
  • On resume, display logon screen: Disabled

Investigation: The configuration was reviewed before implementing the endpoint security control to establish the workstation's baseline state.

Resolution: A screen saver was selected and configured with the required security parameters:

  • Screen saver: Blank
  • Wait: 1 minute
  • On resume, display logon screen: Enabled

The configuration was then saved and validated through an actual inactivity test.

Result: The workstation successfully activated the screen saver after one minute of inactivity and required authentication before restoring access to the existing user session.

Related Evidence: EV-06, EV-07, EV-08, EV-09, EV-10

Resolution Status: RESOLVED

🧠 Lessons Learned

This lab reinforced several practical concepts related to endpoint security and workstation session protection:

  • Automatic inactivity controls reduce the exposure of an unattended workstation by preventing direct access to an active user session after the configured timeout.
  • Authentication on resume is an essential part of the control. Activating a screen saver alone does not necessarily provide the same protection as requiring authentication when the session is resumed.
  • Configuration validation and behavioral validation should both be performed. Reviewing the configuration confirms the intended settings, while an actual inactivity test confirms that Windows enforces the expected behavior.
  • Baseline evidence is useful for demonstrating the configuration state before a security control is implemented.
  • User privilege context matters when performing endpoint security validation. The d.carter account was confirmed as a non-administrative user before the inactivity test.
  • Technical documentation should connect configuration to business requirements. In this scenario, the one-minute inactivity requirement was derived from the simulated Finance Operations security policy for unattended workstations.
  • Security controls should be validated through observable results. The successful activation of the screen saver, authentication prompt, and restoration of the existing session provided direct evidence that the control was functioning as configured.

✅ Final Result

The endpoint security configuration for workstation NX-WS-FIN02 was successfully implemented and validated.

The workstation was configured to activate a Blank screen saver after one minute of inactivity and to require authentication when the session was resumed.

The validation process confirmed that:

  • The d.carter test account was not a member of the local Administrators group.
  • The configured one-minute inactivity timeout was enforced.
  • The screen saver activated automatically after the workstation remained inactive.
  • Windows required authentication before allowing access to the existing session.
  • Successful authentication restored the existing d.carter session without starting a new session.
  • Configuration and behavioral evidence was collected throughout the implementation.
  • The initial configuration state and the final security state were both documented.

Control Outcome

Control Requirement Result
Inactivity Protection Activate after 1 minute PASS
Authentication on Resume Require user authentication PASS
Session Preservation Restore existing user session PASS
Administrative Boundary Test account not in Administrators PASS
Evidence Collection Configuration and behavior documented PASS

Overall Lab Status: COMPLETED

The lab demonstrates a practical endpoint security control for protecting an unattended Windows workstation and provides configuration, testing, troubleshooting, and validation evidence for the simulated enterprise environment.